Analysis
-
max time kernel
737101s -
platform
android_x86 -
resource
android-x86-arm -
submitted
28/09/2021, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
41e17ab631293f4976a503e8aed4dc7f84a55e286b1e49b0b2e4d1432639c029.apk
Resource
android-x86-arm
android_x86
0 signatures
0 seconds
General
-
Target
41e17ab631293f4976a503e8aed4dc7f84a55e286b1e49b0b2e4d1432639c029.apk
-
Size
5.3MB
-
MD5
1eb48628e6ad4c98953e2adc80736675
-
SHA1
e28d9daa3cd5ba16ef724e8dd1c02539d167dc52
-
SHA256
41e17ab631293f4976a503e8aed4dc7f84a55e286b1e49b0b2e4d1432639c029
-
SHA512
295887125e7a3f6ec9c7912fcf80112c060eb809883475c804a94c9b1973fa73d871a1e6ebd1a246d61778f455ecdf65512dd071247c1b3aae213841502483ba
Malware Config
Signatures
-
Ermac
An android banking trojan first seen in July 2021.
-
Ermac Payload 1 IoCs
resource yara_rule behavioral1/files/4708-3.dat family_ermac -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.dkisngicdeza.ptma/wxqeouetaq/xhqlavxmdaffjam/base.apk.jtateug1.qgy 4748 /system/bin/dex2oat /data/user/0/com.dkisngicdeza.ptma/wxqeouetaq/xhqlavxmdaffjam/base.apk.jtateug1.qgy 4708 com.dkisngicdeza.ptma -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.dkisngicdeza.ptma -
Uses reflection 52 IoCs
description pid Process Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method com.dkisngicdeza.ptma.lega$a.m4ecef221 4708 com.dkisngicdeza.ptma Invokes method m0.c.m2510c390 4708 com.dkisngicdeza.ptma Invokes method s.c.f 4708 com.dkisngicdeza.ptma Invokes method m0.c.m4a8a08f0 4708 com.dkisngicdeza.ptma Invokes method i1.j.m57cec413 4708 com.dkisngicdeza.ptma Invokes method s.c.j 4708 com.dkisngicdeza.ptma