Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    easy.apk

  • Size

    2.1MB

  • Sample

    220509-lvgqmschd9

  • MD5

    abb4a1192d0919da01aa87b53538fb7c

  • SHA1

    b998c6de3c3835774eea6519102ce1fc040e33a3

  • SHA256

    a4874ebfe480449a897f86c87a490fbc4c2276d5bad4ff92bc93e2e8ae8efc66

  • SHA512

    32c922b6ae4f12e614b44242d35f662fa22cda62401eac4eb5b26ba25cd72470ccd756fa96674210fa7e63ef9a63da0066107f820abd51acc0f3278f8990c8a9

Malware Config

Extracted

Family

ermac

C2

http://193.106.191.118:3434

AES_key
AES_key

Targets

    • Target

      easy.apk

    • Size

      2.1MB

    • MD5

      abb4a1192d0919da01aa87b53538fb7c

    • SHA1

      b998c6de3c3835774eea6519102ce1fc040e33a3

    • SHA256

      a4874ebfe480449a897f86c87a490fbc4c2276d5bad4ff92bc93e2e8ae8efc66

    • SHA512

      32c922b6ae4f12e614b44242d35f662fa22cda62401eac4eb5b26ba25cd72470ccd756fa96674210fa7e63ef9a63da0066107f820abd51acc0f3278f8990c8a9

    • Ermac

      An Android banking trojan first seen in July 2021.

    • Ermac2 payload

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks