ermac | d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8

Sharing

Copy URL

Twitter E-mail

General

Target

86eb8c78cf477ddc6638da4f4271bba7.zip
Size

1.1MB
Sample

240502-a7g2dseb93
MD5

86eb8c78cf477ddc6638da4f4271bba7
SHA1

41e25c4c13458e192828b45bd764e3847dbef92a
SHA256

d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8
SHA512

d67b1afed0897253aa7a91183526de80d28f9e5b4df2408170f7787fd56011655beaafb42c9ac1f62589601db438d93b0603e7e99704bef29cc5760ed7eea4bf
SSDEEP

24576:zD3rm/4IsL8HQfIjPjSv9AzC2M3jXdiV551DOup6U/Ujy1Zg/g56wQ0:nOS8HQfIn1zvM3ZiV/P/L1Zg/50

Score

10^/10

Malware Config

Extracted

Family

hook

AES_key

Targets

- Target
  
  86eb8c78cf477ddc6638da4f4271bba7.zip
- Size
  
  1.1MB
- MD5
  
  86eb8c78cf477ddc6638da4f4271bba7
- SHA1
  
  41e25c4c13458e192828b45bd764e3847dbef92a
- SHA256
  
  d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8
- SHA512
  
  d67b1afed0897253aa7a91183526de80d28f9e5b4df2408170f7787fd56011655beaafb42c9ac1f62589601db438d93b0603e7e99704bef29cc5760ed7eea4bf
- SSDEEP
  
  24576:zD3rm/4IsL8HQfIjPjSv9AzC2M3jXdiV551DOup6U/Ujy1Zg/g56wQ0:nOS8HQfIn1zvM3ZiV/P/L1Zg/50
Score

10^/10

hook collection credential_access discovery evasion impact infostealer persistence rat trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3