Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2992354s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    24/04/2023, 08:19

General

  • Target

    0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a.apk

  • Size

    4.6MB

  • MD5

    1c74d4eeebdbd04e6f9524f63b15b84d

  • SHA1

    5d86aefe2e6632572b971338a5556ee8a9fc96c9

  • SHA256

    0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a

  • SHA512

    866761e39296f3399a8b0af6209a644a1a54e0a5519130acf0fafc82e11ec36de83c7d4b7d38f4c4606dcae0a0c745d5f2896e8109d4d5c768ecdd04cd0c4852

  • SSDEEP

    98304:k4HuqlDao42RLqaw/jTLq36t+FpyhRTcKm6eAdjTvQlye2tuT/gUMlgm:zHZ2oZ+tm4+fyTTc+JTvy0tK/L+gm

Malware Config

Extracted

Family

ermac

C2

http://194.26.29.28:3434

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac2 payload 2 IoCs
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

Processes

  • com.qjlpfydjb.bpycogkzm
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4138
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/oat/x86/base.apk.kI9Ugey1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w

    Filesize

    1.4MB

    MD5

    6d66718d6b092ebaf2e08f9571dacaaa

    SHA1

    ffec6bba6363ebfb65cb3dc21b992b3dc116c16c

    SHA256

    2b7a055d5d48d8059ecf309f91510af3873caa1c5d5dadbbef5d15ef1dc782c4

    SHA512

    f866daaee7ca1fa4edef60b4d4794579f1aa7fffd729294ec0ca64f4dac950c5ad786c7e425fedcd75401eecb5636060e7fe7c440342d4e947dff7f870d92dfc

  • /data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w

    Filesize

    1.4MB

    MD5

    b6743ab0c201878d1af5f0343ebe8fc6

    SHA1

    01300063b5906c950eff077f3ce980ecefa048e9

    SHA256

    36d11490991e9ec4ca3697e80b83ecca02d4457b71c5586531298766cf7ba8a3

    SHA512

    4f2801d8ca40def3013175fd08ad1a7cb6bd354397c3bcf0aeba01abb11d6189673c06f82e1808e7415ef55018120e31574e9e419baaca71f18e84e6db51a3c8

  • /data/user/0/com.qjlpfydjb.bpycogkzm/shared_prefs/multidex.version.xml

    Filesize

    306B

    MD5

    97c6d0b4ccd3e898d1141a179fe2a479

    SHA1

    b69525c8a5dc96e32f7424138a1369577922075a

    SHA256

    13548b8fc5295a0a5dc46b9a392a083343c41a2a291eea22f4ac72032dc844e6

    SHA512

    abb2961f4e13359669c98a7063cf0953db649ef165646db4baa6096db1589c04cea66d0927668bd0c46b8d342d5daa767f0e3ed05f18f64c4dee18d3a90667ed

  • /data/user/0/com.qjlpfydjb.bpycogkzm/shared_prefs/settings.xml

    Filesize

    136B

    MD5

    6cfa8b67e515d52630433d8c10ab2384

    SHA1

    c872b36e27c8898c3987cc06593d429ea078725f

    SHA256

    679a557dcf4e6a85f851d92a1f6e5f3c9244c1169ae24f99086da95c69b50cd9

    SHA512

    f46eb8374ba84246a226e96069967fc8dc035530b1b7ad192894fc82389dd572461ec85bf4f09d945422267b53bc9fa7d7f35cf99b604e6fe057e92339bba83b

  • /data/user/0/com.qjlpfydjb.bpycogkzm/shared_prefs/settings.xml

    Filesize

    191B

    MD5

    034192fa73a3203c2bce4d5e31ce191d

    SHA1

    1a6aa3e31812e74a15e112cdfb706def366d9ec7

    SHA256

    7844c83773d4f456b1a2cacc1efddb3091494021fecb1153fbb1143fe8102202

    SHA512

    3371e0c8b3bc7a0bd866e6b199f7b43f0af77c8573abb3cb767321c7da73a970c7bf52d636e616695687280cb53ca49c45c0bf4605f9ec5588ad2dad5d913c2e