Analysis
-
max time kernel
1565042s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20220621-en -
resource tags
-
submitted
02-08-2022 06:36
General
-
Target
Xnode.apk
-
Size
1020KB
-
MD5
814aa96cdcf2dc0d70273e81a3a1c86f
-
SHA1
65f97e7a924480cc928424b2d7fa565cf3ad8066
-
SHA256
9f55a2ea4121955b5d2892f11709984d5f0ad6aa7a5a2773b8d5bbc6c04e5fd5
-
SHA512
b28a62e13e3a9448fc92d18c146660073f71d8aa364b477a41402549dc059e3276799ae62c7836d2b0af93db410196ba1ec9f9270c39fd3773cd2bef566ebec3
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://193.106.191.121:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.buxiperutifazafu.cukozo1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).