ermac | 8df476be832a1204480d301c7579597bcdafc690b77d1f5c64dc6fb80c0d90d2

Sharing

General

Target

8df476be832a1204480d301c7579597bcdafc690b77d1f5c64dc6fb80c0d90d2.apk
Size

1.1MB
Sample

240507-v8m91sge9y
MD5

3f9a142aeabaaff9857056dc4a35d495
SHA1

246c4122861876151b6d3e0f17e0460e26bc5956
SHA256

8df476be832a1204480d301c7579597bcdafc690b77d1f5c64dc6fb80c0d90d2
SHA512

1e55f09d8f8e72f9a3cd8ad0e7a986acffe88b5b34f9df7a2e39c4cd2e9cb34b1d85ef72678bc00bc0b6599fa7621518205706342e5c30c207c35a27d993d7b7
SSDEEP

24576:k60U4F837q36KFQLGldSsEEolIYDEBojyFng/lUsY:onKJyldGziXFng/JY

Score

10^/10

Malware Config

Extracted

Family

hook

http://23.224.233.76:3434

AES_key

Targets

- Target
  
  8df476be832a1204480d301c7579597bcdafc690b77d1f5c64dc6fb80c0d90d2.apk
- Size
  
  1.1MB
- MD5
  
  3f9a142aeabaaff9857056dc4a35d495
- SHA1
  
  246c4122861876151b6d3e0f17e0460e26bc5956
- SHA256
  
  8df476be832a1204480d301c7579597bcdafc690b77d1f5c64dc6fb80c0d90d2
- SHA512
  
  1e55f09d8f8e72f9a3cd8ad0e7a986acffe88b5b34f9df7a2e39c4cd2e9cb34b1d85ef72678bc00bc0b6599fa7621518205706342e5c30c207c35a27d993d7b7
- SSDEEP
  
  24576:k60U4F837q36KFQLGldSsEEolIYDEBojyFng/lUsY:onKJyldGziXFng/JY
Score

10^/10

hook collection credential_access discovery evasion execution impact infostealer persistence rat trojan stealth
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Prevents application removal

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests enabling of the accessibility settings.

Acquires the wake lock

Reads information about phone network operator.

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3