Analysis

  • max time kernel
    3316834s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-20220621-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220621-enlocale:en-usos:android-10-x64system
  • submitted
    22-08-2022 13:15

General

  • Target

    106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf.apk

  • Size

    2.6MB

  • MD5

    5f9448f26eefdcb7a0efd580e986426f

  • SHA1

    6a3b4c784e4c08db5ec5d265f935033c8b105949

  • SHA256

    106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf

  • SHA512

    d2ab78caf5faca3f5274da78147217d2974b759100cfa37f9875280606f025d3609cb4166bb4822e081de34496dd48c4f64e8e3653c5c07ecb905a2f443b5272

Malware Config

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac2 payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.jakedegivuwuwe.yewo
    1⤵
    • Loads dropped Dex/Jar
    PID:5275

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

    Filesize

    456KB

    MD5

    2717a78a56c59dd1c7a5f00f2b1034dd

    SHA1

    285d453206526cf8a2b91567f8fb4402be3e04d0

    SHA256

    45444c9c760ff24b43b89ba3d397cc946e276722460be977f59a1b44d9e1a18e

    SHA512

    2a52b2f1b49fbaadda91a506b2c931b789fb6ba3fe966c59b9a40d336d1fc576472117d4ae0554dd451049286e4eca3bd95829c42dc3389602244cf510757a2d

  • /data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

    Filesize

    898KB

    MD5

    c7cb909c28565cb4932ccb19953c4375

    SHA1

    da8f0300b37c4cd3428cda66cc64ff7ef4959549

    SHA256

    7c501b0f8f6b4527c828d4af534f685abe4bebe566691af5a439587c524875f6

    SHA512

    3feefd7d2a37f85887e5135e526847cb835c89879c49df4a2c171707fa1605018dc1311c05534491d38dad7d1a70ae6f8c1426d65fa73445904e409c8685912a