Analysis
-
max time kernel
736993s -
platform
android_x86 -
resource
android-x86-arm -
submitted
28-09-2021 10:19
Static task
static1
Behavioral task
behavioral1
Sample
2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d.apk
Resource
android-x86-arm
android_x86
0 signatures
0 seconds
General
-
Target
2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d.apk
-
Size
3.5MB
-
MD5
678317ea1af55da1cddab31417a3c173
-
SHA1
07f0fb32e675ae022c96a54ac4ed7aa0c21c052d
-
SHA256
2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d
-
SHA512
b135fbedddfb0c1942a59ac016159273ad0f50b717412520a22b48bc2c953134033930dcd751fc7018abcf765908f954f27b5b0f1ba323a914e090cd232a6df7
Malware Config
Signatures
-
Ermac
An android banking trojan first seen in July 2021.
-
Ermac Payload 1 IoCs
resource yara_rule behavioral1/files/4885-3.dat family_ermac -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/base.apk.classes1.zip 4916 /system/bin/dex2oat /data/user/0/com.hxfumpfgokky.bufvpk/code_cache/secondary-dexes/base.apk.classes1.zip 4885 com.hxfumpfgokky.bufvpk -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.hxfumpfgokky.bufvpk -
Uses reflection 47 IoCs
description pid Process Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk Invokes method com.hxfumpfgokky.bufvpk.luhawehaho$a.m23178070 4885 com.hxfumpfgokky.bufvpk