Overview

overview

10

Static

static

7

c6c30839e1...6c.apk

android-9-x86

10

c6c30839e1...6c.apk

android-10-x64

10

c6c30839e1...6c.apk

android-11-x64

10

Analysis

  • max time kernel
    3418147s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    12/10/2022, 10:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c6c30839e1e885d4a54fe9d8d3a68b3e1c79e27e15c9a76907ba58a954d8476c.apk
  • Size 2.8MB
  • Sample221012-mf6lwsdcen
  • SHA256 c6c30839e1e885d4a54fe9d8d3a68b3e1c79e27e15c9a76907ba58a954d8476c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ermacbankerinfostealerransomwaretrojan

Malware Config

Extracted

Family

  • ermac

C2

  • http://31.41.244.187:3434

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.zixudahitifo.gicu
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4755

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ZnXAwQI.json
        • Path /data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json
        • Size 444KB
        • SHA256 7293c3bd06c36eff25632488bd2d84d0b22917a14bece9464fd777177ffe2ee2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ZnXAwQI.json
        • Path /data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json
        • Size 911KB
        • SHA256 432c766cb9e36d58b08319a5beb7f0176b394be06c6778f9bd0c6e23a3b81365
        • MD5 SHA1 SHA512 SSDEEP
        Download

        Cookies
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/Cookies
        • Size 64KB
        • SHA256 f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cookies-journal
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/Cookies-journal
        • Size 1KB
        • SHA256 618ec47102203dfd958eb30d9f698b3a1e00e1716cd6c4a94640346184a2a904
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 9a3a6027bf69bf0982e0bbc99c79c9d0e43ac243dde141f346c3ec916836d997
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/Web Data
        • Size 112KB
        • SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 4ac6c5ae636366c39a56f09eb9b435263e4a1f7c294d6b8a0d7e26d56b7d706c
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.zixudahitifo.gicu/app_webview/metrics_guid
        • Size 36B
        • SHA256 aaf0cd078a229327fb54b29d96b8155dd2f6b93b033e2d89a04c9056962adf9f
        • MD5 SHA1 SHA512
        Submit Download

        settings.dat
        • Path /data/user/0/com.zixudahitifo.gicu/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 4c60f659514800dbbe22f7bfef36b0dce944cc09fa09850ffbd24fbc4141d707
        • MD5 SHA1 SHA512
        Submit Download

        1dc40779bb8387b8_0
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/1dc40779bb8387b8_0
        • Size 426B
        • SHA256 4a4f655ed5b28fd7cab963e9a28ca012dd589e30a355a792392791933983bbf0
        • MD5 SHA1 SHA512
        Submit Download

        4c70d54a92cdffb7_0
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/4c70d54a92cdffb7_0
        • Size 514B
        • SHA256 20dd7a255bd273d4eee47bf8e6ddcf8f352655a727fe98f0ed86c5ec559d6daa
        • MD5 SHA1 SHA512
        Submit Download

        74a997b66d0f8136_0
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/74a997b66d0f8136_0
        • Size 492B
        • SHA256 800726bcbc84679265d57df2f28839b480f5abd922fb5781e5eef88a8b3146bb
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 de82e08ce1762ef3f1577ad6ac964344d1c09f504d64b432bd330fd398f660b7
        • MD5 SHA1 SHA512
        Submit Download

        a63f6ad0ba0d5e6b_0
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/a63f6ad0ba0d5e6b_0
        • Size 310B
        • SHA256 956425034ffb1ceba3e40d161917f2ebebbedf29d0971fb17afb2ab3d5e810f7
        • MD5 SHA1 SHA512
        Submit Download

        c4c671fa17cf644a_0
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/c4c671fa17cf644a_0
        • Size 472B
        • SHA256 21c0cca083c2d97aebf8177cddec34f581ee58381a6cd03f5b1a1005e48535c5
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 240B
        • SHA256 799fe8f640abc29174768f8df07a4dc14d233e221f6e8ef67a456600945c555d
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 96B
        • SHA256 8978977141c35b012963c26a456b1d96c4e61637f02607d8a63102263daa99aa
        • MD5 SHA1 SHA512
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.zixudahitifo.gicu/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
        • MD5 SHA1 SHA512
        Submit Download

        settings.xml
        • Path /data/user/0/com.zixudahitifo.gicu/shared_prefs/settings.xml
        • Size 134B
        • SHA256 a98f1264aab26b21d005fecbb0db2e746bd2b24ae04c3dbae162f6436206e3cc
        • MD5 SHA1 SHA512
        Submit Download