Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3985896s -
max time network
52s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
30/08/2022, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce.apk
-
Size
1.5MB
-
MD5
548b51ca14154fbd6f13b7ce97802020
-
SHA1
9fe55567e69413b5f49af51121c05fc2515d8364
-
SHA256
23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce
-
SHA512
e9a1867c81fb1d75ac152025e08308b7910a65ec430a2382555fe7ea0e2e20c7bc0f42d6d2dbdf359ddec5f987769ec1975d1a75b5e31f8f0082a017ee2fabec
-
SSDEEP
24576:DtZAIzFHDjOTr4fwWt6kk0dQcsLKOr2oCndN0eqxqyuMjxz2uelu363C6l:xbzlK/4f16kO26eWQ73C6l
Malware Config
Extracted
ermac
http://62.204.41.98:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 2 IoCs
resource yara_rule behavioral1/memory/4117-0.dex family_ermac2 behavioral1/memory/4065-0.dex family_ermac2 -
Makes use of the framework's Accessibility service. 1 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.yusozofasuga.dadoduva -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.yusozofasuga.dadoduva -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json 4117 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/oat/x86/gLKsqo.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json 4065 com.yusozofasuga.dadoduva -
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.yusozofasuga.dadoduva -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.yusozofasuga.dadoduva
Processes
-
com.yusozofasuga.dadoduva1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4065 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/oat/x86/gLKsqo.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4117
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD5c373a9c922dfd38ae95052d9b42b806d
SHA1e9dde6b9f42e4ab98f467d30b4aa50899984ae14
SHA256c0d33f70ce1906ee68d0438cef8147d51854a22297988635b6e7669008e9eefa
SHA512eefa473020a6d0d7e25ce81ddfb07f83005ffbef9da0ea7dd0967eb894e6706555e33cf18f3d3a282e15bdef893d896dcac1f4f33f0a10be75ce4260cc854ea8
-
Filesize
890KB
MD54b3296f3dc431545736e917509ba82c9
SHA1d57bb111ed9af2804db007adc358dc3e6bae7e0b
SHA25617731dc7e3b784fed6392476296050ba62a4423bf3b9dcb5758fe4930ce66315
SHA512c6aec0e423e5c78a74c2e0de8550303e59990a70f56bf51390ee4083b7ed8ab7de41df0558812854e4f9f78bc0ba45cf78458207e053dd6d346fa49855f2c47b
-
Filesize
890KB
MD5ab16e04b52e006b2f1317a485000359f
SHA1dda556bcecd7e19fee1735fa10562d898452ecbd
SHA2567d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e
SHA512ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699
-
Filesize
138B
MD5f667e0f82295d0aa77ea11108569a1bd
SHA19292fcc859847dde46951cd27094a703163b2c89
SHA2562348227481c31a02a19cc2470c337ce167aef1aeafed1a7a422c984de0ee6d57
SHA5120d16a0591d2d7e7305d440a6b894199e426e64c6637a3847b737e8cb9b52807eceb7a4ae84c1263137d1a5feb0132a9a420364989f9c5a5b7e5bbc4e68c0dbfe
-
Filesize
182B
MD58b4198bf5d5262dc59ea81dc0eb48063
SHA1b45aaa889b1e76b40a758f7a9fd658ef49cf117a
SHA25692391917e8a542c01a35b7b78acd601880e39f24ec349e4225baaa0f7d76dd81
SHA512f8cf8da4f89e5577ee3af5f306ff9f8c70a3f820669ed51093551d5aac96add69ea1da8400354dd63f5f0e64cb55c99723668ee96e3270e058b92f38c6ce6e2f