Overview

overview

10

Static

static

10

aea84ebd9c...31.apk

android-9-x86

10

aea84ebd9c...31.apk

android-10-x64

1

aea84ebd9c...31.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d0c23a96dc90d431a8ce01f0cee1575.bin

  • Size

    2.6MB

  • Sample

    240620-bgkv2avclm

  • MD5

    021d816e2c9cacc41a072127d0416661

  • SHA1

    3e85635578b69ece2b9e5b909b5288a46098089c

  • SHA256

    c274e1c3eb15ebc79f91814fb5b4eb53380890c936529adc5903def3f04fa2f7

  • SHA512

    bf0809fdea371bb068f10767cc1b8b02e291f6dd1caeb0b5c60d2e524959574e8747a251949f82068db2a7cc7d073ac527ce85d18f2c0a851fea949e7390fd8a

  • SSDEEP

    49152:9TDpdfOP7KIq3tNP+V5DepvuX/ekYAAdd8j+2NtSl4pIXTyVHoeTiBJTlW:9TfOP7KTtnpvK0vd89YlFXTkIeSk

Score
10/10
ermachookandroidcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

Malware Config

Extracted

Family

hook

C2

http://91.92.254.104:3434

AES_key

Targets

    • Target

      aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531.apk

    • Size

      2.8MB

    • MD5

      0d0c23a96dc90d431a8ce01f0cee1575

    • SHA1

      8605f8fb9d5de85b5bca0aa953ea2ea8df53cf84

    • SHA256

      aea84ebd9c1194efa69033231fe055a9fa79f3e740825965ab2767c4f61b0531

    • SHA512

      7858bdf897659898c018aa2191f87cac4effa93e95daf3c4e449bbbafad1ab8248df0bb97e599e7f81a3dad0ddb3041ad712c8198a1b8635ea0b09f4849fc7da

    • SSDEEP

      49152:mAT2grdSkQvKiMqFnr8CJMtvlB0l1EIFWEog1cJXCDG9XU3g/KZ:mAT2g5TQSSlrxmdva1EUag1cX8eXKZ

    Score
    10/10
    hookcollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

    • Hook

      Hook is an Android malware that is based on Ermac with RAT capabilities.

      rattrojaninfostealerhook

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

      discovery

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks