Analysis

  • max time kernel
    1657137s
  • max time network
    189s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220621-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
  • submitted
    03-08-2022 08:11

General

  • Target

    Xnode_new.apk

  • Size

    1020KB

  • MD5

    814aa96cdcf2dc0d70273e81a3a1c86f

  • SHA1

    65f97e7a924480cc928424b2d7fa565cf3ad8066

  • SHA256

    9f55a2ea4121955b5d2892f11709984d5f0ad6aa7a5a2773b8d5bbc6c04e5fd5

  • SHA512

    b28a62e13e3a9448fc92d18c146660073f71d8aa364b477a41402549dc059e3276799ae62c7836d2b0af93db410196ba1ec9f9270c39fd3773cd2bef566ebec3

Malware Config

Extracted

Family

ermac

C2

http://193.106.191.121:3434

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI).
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.buxiperutifazafu.cukozo
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5327

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads