ermac | 50ffa9268da4db6886903db61e75a0d96b2f516130e84ef99e59ccf06d7ba933

Sharing

Copy URL

Twitter E-mail

General

Target

d44e53ca92e43d18e026f48ce295b02b.bin
Size

2.6MB
Sample

240503-b4jw9aea65
MD5

2267877347813775b6f7f7517e1e0d30
SHA1

addbcc4bee6dba0c0aaa95cfb26c6b391ba9bba3
SHA256

50ffa9268da4db6886903db61e75a0d96b2f516130e84ef99e59ccf06d7ba933
SHA512

c9258dc17e4a17c966877a6d11e358cd1246171f33a5d30b17ff8c5abc26189e7093d05fa8957015c824c599a56a2e573dd523ddc8c80f7266742064ab6f78fe
SSDEEP

49152:eO+mCEG7bJpv/Zfk9oC3fxpAva3BY/9nJz6odYGgmp7Q+K0JeBe:L+mC7Js9osZq/vfZ7Qm

Score

10^/10

Malware Config

Extracted

Family

hook

http://54.36.113.159:3434

Targets

- Target
  
  bc0b22a27dc2865e3194c23a0555fb791a17da00ed8935b7d0a118262c786f0b.zip
- Size
  
  2.8MB
- MD5
  
  d44e53ca92e43d18e026f48ce295b02b
- SHA1
  
  eb924475a2b085bcc45e3109bf77886eede1126d
- SHA256
  
  bc0b22a27dc2865e3194c23a0555fb791a17da00ed8935b7d0a118262c786f0b
- SHA512
  
  ede5b7443b32fa71bcc9f9bcac540981a2755a2b5878033f0957683d33b0bceb5b2d4392fe5ba49e1911524a5f67a580aa3b97b258235c74e970751a1377ed56
- SSDEEP
  
  49152:G0mdqy656RS1b0R3FJLeISGmAchVJGa7Zff3y7GdfSU8QUOcv/pw6jg/RV3:G0mdqb6RwbSuhG9Uia7ZfPy6xSU8l/pm
Score

10^/10

hook collection credential_access discovery evasion execution infostealer persistence rat trojan stealth
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Prevents application removal

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3