Analysis
-
max time kernel
3986053s -
max time network
185s -
platform
android_x64 -
resource
android-x64-arm64-20220823-en -
resource tags
-
submitted
30-08-2022 07:07
General
-
Target
d6299da308a53c7bb6ac4ab52fd79e1732c67c39b55b7fa5e5c581b1eb15f2f3.apk
-
Size
2.0MB
-
MD5
e16a2e97078de0749a6be9a2504b1025
-
SHA1
b669aa8644884829c1b5b796ac72308697c2655f
-
SHA256
d6299da308a53c7bb6ac4ab52fd79e1732c67c39b55b7fa5e5c581b1eb15f2f3
-
SHA512
acd57cdbe152de795cf47f589cb29671b8a2538acb83d4e076368bba3035353a68acd424b05b39356d0c7bf3042a0ee48f29ca4d0e3d9cafb5d37f6d944a2be5
-
SSDEEP
49152:0Vc4/V5nXH4f6hhL9m1RYZr3ZvKzfUKwQYKJ0:wcYnXRpYYhpvKQSYu0
Malware Config
Extracted
ermac
http://62.204.41.98:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.yusozofasuga.dadoduva1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD51a017ad50f8d159b9a948c171637c734
SHA137acad4eaf6d0a8b4d83339b44a789dbce145091
SHA2568fc437dc0501819de410434c1ae6bf8d00a5db69e8013b00500eeb71568c8e3d
SHA5129ac8dbbb660aef623b01f9599f4c813dcf52529776cef3d9669989a93c0df7eb29f783850300d6e6dcf70b638b0be2afd21c0be9c7a25932b8511ef67d7a58f2
-
Filesize
890KB
MD5ab16e04b52e006b2f1317a485000359f
SHA1dda556bcecd7e19fee1735fa10562d898452ecbd
SHA2567d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e
SHA512ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699
-
Filesize
138B
MD5f667e0f82295d0aa77ea11108569a1bd
SHA19292fcc859847dde46951cd27094a703163b2c89
SHA2562348227481c31a02a19cc2470c337ce167aef1aeafed1a7a422c984de0ee6d57
SHA5120d16a0591d2d7e7305d440a6b894199e426e64c6637a3847b737e8cb9b52807eceb7a4ae84c1263137d1a5feb0132a9a420364989f9c5a5b7e5bbc4e68c0dbfe
-
Filesize
182B
MD58b4198bf5d5262dc59ea81dc0eb48063
SHA1b45aaa889b1e76b40a758f7a9fd658ef49cf117a
SHA25692391917e8a542c01a35b7b78acd601880e39f24ec349e4225baaa0f7d76dd81
SHA512f8cf8da4f89e5577ee3af5f306ff9f8c70a3f820669ed51093551d5aac96add69ea1da8400354dd63f5f0e64cb55c99723668ee96e3270e058b92f38c6ce6e2f