ermac | fb3375e035518ce5d71bf5038b8870b5246c2a2d2e06628350322e6ada734234

Sharing

Copy URL

Twitter E-mail

General

Target

e07fd729182650c77f29293c6e4522c5.bin
Size

900KB
Sample

240503-b8tl9aca91
MD5

f46dbaa99fd94e6cf37bcfd3f342b655
SHA1

374bba533b4590d8e1b0b8db3b96b315bedfa327
SHA256

fb3375e035518ce5d71bf5038b8870b5246c2a2d2e06628350322e6ada734234
SHA512

c173696a445fa90f136ba092f304fd7e4708f4467b26e48ae39ecf3081be240e1cee9a558a41082d93357b9f657343557bf0735e1c0a6b32c726fc41b367a8c8
SSDEEP

24576:Pb8m7MSsdJcYFtc2U0qtvY8XNWYTr6vC+SZ8a:TbMda2URv1NWYCvE

Score

10^/10

Malware Config

Extracted

Family

hook

http://54.36.113.159:3434

Targets

- Target
  
  697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0.zip
- Size
  
  1.1MB
- MD5
  
  e07fd729182650c77f29293c6e4522c5
- SHA1
  
  9e0c183e6ef61953cea9d29bf4fc6ea2cbd8a164
- SHA256
  
  697a13b1358a09008afcf17117a04cb253a11a30cd24944be1c60a4696dc27f0
- SHA512
  
  8673e7b983773e58f83d4a75b7a7cc7dbb6d0bfcc16d47848800cd491fb224880e1867fe198ac35f3dec496f2154a5792539bfa2e27cb557336331379e86dca7
- SSDEEP
  
  24576:sbKs3t7YSbMlettFATgZYfw20V/ojyx5g/Qn2q:zW5YSRFATgyfw2E/Xx5g/7q
Score

10^/10

hook collection credential_access discovery evasion execution infostealer persistence rat stealth trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Prevents application removal

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3