General

  • Target

    7a4238fc6f5d3c7731c2eb33911298eaa36986040858af56e76628c5dc83e265.apk

  • Size

    1002KB

  • Sample

    240628-bwemkatdnd

  • MD5

    5526e85de73065e2580bbdb5ed4fc9cb

  • SHA1

    5114d93500e55d3b4829423e0debfa4329d6f0f9

  • SHA256

    7a4238fc6f5d3c7731c2eb33911298eaa36986040858af56e76628c5dc83e265

  • SHA512

    c6aecaf46485ee6dacd80cd13857a4c38c56b3074b83ceb355b287ba5d947536e07445c3551276b734fe866dbd6bc4e1a54b3fb7800da5fe7709f820aa5ba255

  • SSDEEP

    24576:/1GA92E9imQxV4ffopXIzJs/d8zd8ld8Cd8ed83d8Ad8Ld8Od87d85+p:/wA9c/4fSgp

Malware Config

Extracted

Family

ermac

C2

http://103.139.1.202:3434

AES_key
AES_key

Targets

    • Target

      7a4238fc6f5d3c7731c2eb33911298eaa36986040858af56e76628c5dc83e265.apk

    • Size

      1002KB

    • MD5

      5526e85de73065e2580bbdb5ed4fc9cb

    • SHA1

      5114d93500e55d3b4829423e0debfa4329d6f0f9

    • SHA256

      7a4238fc6f5d3c7731c2eb33911298eaa36986040858af56e76628c5dc83e265

    • SHA512

      c6aecaf46485ee6dacd80cd13857a4c38c56b3074b83ceb355b287ba5d947536e07445c3551276b734fe866dbd6bc4e1a54b3fb7800da5fe7709f820aa5ba255

    • SSDEEP

      24576:/1GA92E9imQxV4ffopXIzJs/d8zd8ld8Cd8ed83d8Ad8Ld8Od87d85+p:/wA9c/4fSgp

    • Ermac

      An Android banking trojan first seen in July 2021.

    • Removes its main activity from the application launcher

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the phone number (MSISDN for GSM devices)

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks