Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

foto.apk

android-10-x64

10

foto.apk

android-11-x64

1

foto.apk

android-9-x86

10

Analysis

  • max time kernel
    3990797s
  • max time network
    145s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    26/01/2023, 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    foto.apk

  • Size

    2.9MB

  • MD5

    ff5a7566ac2095f3b379c46cb63fd84c

  • SHA1

    716e5a95de367246f5ebc81f955c0a99de57d43a

  • SHA256

    52fb1a93e8366862c7dff046ed8a6f45ad0589fa7a1feceb4aa7cffd5d5cdca9

  • SHA512

    425c5c6eee15cc2bada96e7e9201d063ba63a572c1ce2f1ef829fa5f0d26966f57e0ab64b46ac15b5aeee58b907e4940ff7b82008478d73395128b265b07853b

  • SSDEEP

    49152:YpevLSq/mZoCAdmogSuH7Zdhv/HQF+dL8loJ0VlOoec:0evLL/CoCemPHt21Wc

Score
10/10
ermacbankerevasioninfostealerransomwaretrojan

Malware Config

Extracted

Family

ermac

C2

http://176.113.115.66:3434

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.zuvagelizesiho.lihupi
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4022
    • /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.zuvagelizesiho.lihupi/app_DynamicOptDex/sPR.json --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.zuvagelizesiho.lihupi/app_DynamicOptDex/oat/x86/sPR.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.zuvagelizesiho.lihupi/app_DynamicOptDex/sPR.json
    Filesize

    470KB

    MD5

    13789b90f7d0ed4537ce4f7128aee49a

    SHA1

    503a866814397db0e861a9488a2d066e262fe960

    SHA256

    aaca0266b89e4a3187d8b01dab371c1c23f1055b5ef32a975509caa39c489341

    SHA512

    ddb3b257d19a3f616119af210eed6b67355795ae14be1d4c85ccadcc05a8637e016cb09e78764b141a093432827448a22dabe70744f405ba511b05effffcd00c

    Download Submit

  • /data/user/0/com.zuvagelizesiho.lihupi/app_DynamicOptDex/sPR.json
    Filesize

    914KB

    MD5

    af5dde2273ba15fb627fd8781914e52b

    SHA1

    1d69ef96a3011687135041b3c0d62a48e024d180

    SHA256

    71d60c0aab62e505f7ee4dd5f5a20dc1125d0b13fa4d3b17ca6593adc19f80ac

    SHA512

    36f3143f6b817a0fa0075b9d69ab99e66fefcd7dc03eacd21deb21301def295db2d97c1b642fe2e300305dc8a7e21c529a0fb689de08adbe1fd500934084a799

    Download Submit

  • /data/user/0/com.zuvagelizesiho.lihupi/app_DynamicOptDex/sPR.json
    Filesize

    914KB

    MD5

    af5dde2273ba15fb627fd8781914e52b

    SHA1

    1d69ef96a3011687135041b3c0d62a48e024d180

    SHA256

    71d60c0aab62e505f7ee4dd5f5a20dc1125d0b13fa4d3b17ca6593adc19f80ac

    SHA512

    36f3143f6b817a0fa0075b9d69ab99e66fefcd7dc03eacd21deb21301def295db2d97c1b642fe2e300305dc8a7e21c529a0fb689de08adbe1fd500934084a799

    Download Submit

  • /data/user/0/com.zuvagelizesiho.lihupi/shared_prefs/settings.xml
    Filesize

    138B

    MD5

    82a70ce07c0ea80719dd2f2c1378852f

    SHA1

    6134167420ded4fb7a6bd711f51d14b2149e8a01

    SHA256

    c3769fcf98fe656efeda921c4d05924dcec1ac34352813f871e6b2a330472940

    SHA512

    221907f6c99a7d2a1aaa5474e7671dc8667c40e1385bb602db4a268989ae0939e07014dbd54a0a43e985c9b6c8e875c35e363f92bb9afdc788f1f6db7348d094

    Download Submit

  • /data/user/0/com.zuvagelizesiho.lihupi/shared_prefs/settings.xml
    Filesize

    181B

    MD5

    6f0f8b4734c9ab8558416a86fc0716d3

    SHA1

    25f6685e16cde27d46e452900c5d8cc45b65f9d6

    SHA256

    33c1d8bad0d2e0d37aaf5912c4e27e8df367ed95c02d5c0793449170bce541c2

    SHA512

    866411ba04a93ef58704cc42313ccb5bfac80793a2c9a922e4d4f5751e500bb61df7e93608896f00f764478ea7fe9086b9d62fcdfd6ba4c2b4c16cca05734791

    Download Submit

  • /data/user/0/com.zuvagelizesiho.lihupi/shared_prefs/settings.xml
    Filesize

    269B

    MD5

    34edb5fa0408be5375e70c0982315ecf

    SHA1

    46b7416cc55885d24f73ae9cf742079beedf7579

    SHA256

    5b7e104b0382d305d9a9e0904e42fc5faabc70b48f51d03fa7934a50b9b37401

    SHA512

    43e1d13344c5bdf430536a885b268b9cfaa3180f26a872a2b356d3e1343f37a76c90fb1771856caa1aa5dcdc73b45c47ccd22bb617f8980c56b56809e3599c23

    Download Submit

  • /data/user/0/com.zuvagelizesiho.lihupi/shared_prefs/settings.xml
    Filesize

    313B

    MD5

    744c48212b039e406d7be927e0d98a99

    SHA1

    6d2f52ba3b20a59fb32988868e1133db975a322b

    SHA256

    7034a0e833cc3231531d3820491da513cc7be49a52409708476bc882bb2e68e6

    SHA512

    b0024b5ffbc29aa0635da1cf9a02e0f993ab6abf698e451e76764813ee9871637789cb37c11516b6f3909454f753f19757ce4253c16137d666842bd1a63d5118

    Download Submit