Analysis
-
max time kernel
1564575s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
resource tags
-
submitted
02-08-2022 06:21
General
-
Target
photoapk.apk
-
Size
2.3MB
-
MD5
80714569a9addf2781596516ba954c57
-
SHA1
4bdf1933942683b63e4bdffd4c0e7c41ddf7ccc1
-
SHA256
ca56e3f365cf8400b677c650250c37c967ead4d06f79620bcec7f73818bdfb46
-
SHA512
06bdf0c5251563b499ba6aaf2896dc060531220459c6a3733182fa41029931bdc2df4bbd8e6f97ea15312df44a4a0d4adfac1929dc374047bed3f5076a9b9aa8
Malware Config
Extracted
ermac
http://193.106.191.118:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.majosiwuxexeku.poniva1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD57d05175076aa943713eb53d1b36ad2f8
SHA1c8b26d48eb0af8d326ae4cce21d8088c30fac51f
SHA256b91dc7bfd7d4d028eae574532e03f5cfb46c24547e61ea3bc34f635d9ef50fca
SHA512136ab98c3855c9a2d38833d0446de9e66f5d9c805b9e974b98838e240e86ca36d3d9e8f7e3fb7e975d2439555a94fc32a6b9e57ffa4c9a7d8036b8b4f68db113
-
Filesize
899KB
MD52bb06ce0b418fd54fa36013d131be94d
SHA1a6ee5722c0d0c0dce1d3524d29aca334588c509a
SHA2562e3a210d1821ff63420c1018a7598e321b021c4a9e85661b8d6714c4c379b75b
SHA5126de4702b7a2e381de4a368e814fe6c3251d1b90d8ccc9753bd50991205cfbc7832eee158a2889f3d8f861edf0ebe9d6754af1851faafab69e1ab32e50e5e53ec