Analysis
-
max time kernel
928903s -
platform
android_x86 -
resource
android-x86-arm -
submitted
30-09-2021 15:37
Static task
static1
Behavioral task
behavioral1
Sample
db6246bd102fdfa9614a9fa5968362c5de8a3bb1cd23b5740392210d20a7d22a.apk
Resource
android-x86-arm
android_x86
0 signatures
0 seconds
General
-
Target
db6246bd102fdfa9614a9fa5968362c5de8a3bb1cd23b5740392210d20a7d22a.apk
-
Size
3.7MB
-
MD5
282b35ed9551c6f79e123bb2d2a956fb
-
SHA1
a92dd02afb3780bfb5d0e1b9dc845d0325c59ddf
-
SHA256
db6246bd102fdfa9614a9fa5968362c5de8a3bb1cd23b5740392210d20a7d22a
-
SHA512
36c4774de4e1c2ecac8dc2cd5502152d25352bf595de41634a478879819cd41c89e913960c704cb6ca1943741da9be34d9b008e3f6cf9061a61860b18de34b0b
Score
10/10
Malware Config
Signatures
-
Ermac
An android banking trojan first seen in July 2021.
-
Ermac Payload 1 IoCs
resource yara_rule behavioral1/memory/5087-0.dex family_ermac -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qyouyvieqsyf.wotpln/unkexmgdfd/kntdxlccbynljlq/base.apk.fxogacv1.mrs 5087 /system/bin/dex2oat /data/user/0/com.qyouyvieqsyf.wotpln/unkexmgdfd/kntdxlccbynljlq/base.apk.fxogacv1.mrs 5058 com.qyouyvieqsyf.wotpln -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qyouyvieqsyf.wotpln