Analysis
-
max time kernel
735123s -
max time network
20s -
platform
android_x64 -
resource
android-x64 -
submitted
28-09-2021 09:47
Static task
static1
Behavioral task
behavioral1
Sample
495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617.apk
Resource
android-x64
0 signatures
0 seconds
General
-
Target
495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617.apk
-
Size
3.7MB
-
MD5
a88a497b3ae6bb84209cac0906df61a7
-
SHA1
fd80903a98e187bc841a0aabe04528cc1654b8ee
-
SHA256
495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617
-
SHA512
684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a
Score
10/10
Malware Config
Signatures
-
Ermac
An android banking trojan first seen in July 2021.
-
Ermac Payload 1 IoCs
resource yara_rule behavioral1/memory/3642-0.dex family_ermac -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi 3642 com.tafupqzpqgmn.tmnhkq -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tafupqzpqgmn.tmnhkq