Analysis
-
max time kernel
1563939s -
max time network
168s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
resource tags
-
submitted
02-08-2022 06:18
General
-
Target
1-aligned-signed.apk
-
Size
4.8MB
-
MD5
077f37ae6db44e03f7405f79bab2f825
-
SHA1
a1a303b33faeabbbac894f070f3691a76ec6d85e
-
SHA256
03b3fedafc53ef59995d4ff7ceda79317c6d73205a418a8d579815434dc955e9
-
SHA512
c5e220c617fe3e855d3e8a71c48870f0f1b7b2199fc7d2708f0033eb376a0a1a9005bc509b88cc17cae1d6b4900093bd1dee1151ad129c3f24a664e666c0c31b
Malware Config
Extracted
ermac
http://5.188.33.192:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.uywntbmlvxew.wwaajzop1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306B
MD505b083b27c6a32315bdd9861c6db9e55
SHA1f91ad8c836c0eca044a4e074a465f0d802d7521c
SHA2569ca7acd9bbecc45206602cad0325dbdabf3d6a8b07397823909715cddb83f8a1
SHA512de66ed303289d069ea250f04d2ea3ebe8f8e148c702427394f085fe2451cde17a2bc899591a13b88efb6a4312f3885cf566d2d9fdb314350e68797e97d4ca758
-
Filesize
1.5MB
MD5c346314fd47e4ae7c8bb7a51f2cad555
SHA1c8f08ff60778241c8882ba6de72af5968ded3d5b
SHA256e02d19c0521933752c9e2a52a4720f9226320fe1dcd7f77370caf51ef1b6271d
SHA5122efa8447fce698cd1c698a8891293d8a61bc5533e06c39a3fe0dc2b1d1049b1fc324156c5b353eea13cac1c60489580e5bddfdff79a39dc1d60863a5b48734fc