Resubmissions
13-07-2022 10:04
220713-l3xrtscgdn 8Analysis
-
max time kernel
4144398s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
submitted
13-07-2022 10:04
General
-
Target
53.apk
-
Size
2.3MB
-
MD5
532976a909d2a833efb1dea9f025d63b
-
SHA1
6af5fc7790be9c0ff466e31dd33ace5b587d2674
-
SHA256
e726697d7f682a6b2be61ae887b80275ca124da0350020ead46c52781bd22e39
-
SHA512
83eb6c4c17715936ea8d38b7a92e73a82de91283b7acdcbe9b39aaa9bf18d33441a1f6712a9b32c1e9ee05134725e21f08dc510af387d9a6dbee59a02c7fe078
Malware Config
Extracted
ermac
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.dakerebutisi.lozaji1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
445KB
MD5c8d1138e431ea1a179a8234e200012b5
SHA11ce4de7c00e2759a919eacb287bb3c5496c42285
SHA256c32fadead663361c1dc51ecaae48f69ac61c1fbad44b9696b32fd01248a9e777
SHA5127d86a02afaa29c50b61f6fede260fe42d44a0d8277297a8b18ffd9883aa8e670f5dc04f31d2e6f0fbb652f307d45a24f8ccf4d81353f6c5873e43bd794f53650
-
Filesize
877KB
MD5260e6e7f0d536c107fcde973f61af176
SHA187b18261b58ab77fa6c7fe60e3f51fe67e4e7cc6
SHA2569c086b58b55afd9dfa32847b5d5f87fa2eb029a8d9f5a343c8a3d7051fc28bb2
SHA512f07d5a6ea4f351d873d383fc0d13aad2f4eb30262d51df936d909cc3f0731c8250ba2e5547d2ea4af044e9efdcb4e2569eb86fa5db94231a42615c186fe8d5ca