Analysis
-
max time kernel
1565082s -
max time network
146s -
platform
android_x86 -
resource
android-x86-arm-20220621-en -
resource tags
-
submitted
02-08-2022 06:36
General
-
Target
GoogleMaps.apk
-
Size
907KB
-
MD5
ea449f22d8dd8d8fe8732dd96d69cb99
-
SHA1
d0656d504fabddb0bccc284976120e1a8299dcde
-
SHA256
16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a
-
SHA512
0da0a54de3cc28d3d8f8e44748aa2359f048f4c21d319fb2941bd2b4866bb53abdd857b5f27a346daa5b7f79b9a68af89baff598133fb8fe0c1633a820328fe7
Score
10/10
Malware Config
Extracted
Family
ermac
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.ceveluriseze.xuca1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).