ermac | 7c5b8ef2ef5755e0a981910792be222ceade41eb99235df3b0010b65dacc6cdd

Sharing

Copy URL

Twitter E-mail

General

Target

86eb8c78cf477ddc6638da4f4271bba7.bin
Size

901KB
Sample

240503-bqy41sbe7z
MD5

eca491e0f8ec643be24f806a65b095e4
SHA1

785c5162cc6729c03f7cefe86a006453036ca1e1
SHA256

7c5b8ef2ef5755e0a981910792be222ceade41eb99235df3b0010b65dacc6cdd
SHA512

94776c94ecaf0524978448515b9e46d2d2de32d7386741e17ee7ec03dc871131c94431cd9af927b35fcff2749a776fbddc7cdb5a7c3d86da7e6820e593de9ffa
SSDEEP

24576:qt0RYFVu9FumrVrxVoFy9B732WUZpEKF+bnECJ91U:qtFMumZrxV39ByWUZp2wK9i

Score

10^/10

Malware Config

Extracted

Family

hook

AES_key

Targets

- Target
  
  d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8.zip
- Size
  
  1.1MB
- MD5
  
  86eb8c78cf477ddc6638da4f4271bba7
- SHA1
  
  41e25c4c13458e192828b45bd764e3847dbef92a
- SHA256
  
  d37a174544220e93a0425afce2b1e76b8b29c97ce18588037ae76b45c26d08b8
- SHA512
  
  d67b1afed0897253aa7a91183526de80d28f9e5b4df2408170f7787fd56011655beaafb42c9ac1f62589601db438d93b0603e7e99704bef29cc5760ed7eea4bf
- SSDEEP
  
  24576:zD3rm/4IsL8HQfIjPjSv9AzC2M3jXdiV551DOup6U/Ujy1Zg/g56wQ0:nOS8HQfIn1zvM3ZiV/P/L1Zg/50
Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Prevents application removal

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3