Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2992354s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
24/04/2023, 08:19
Static task
static1
Behavioral task
behavioral1
Sample
0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a.apk
-
Size
4.6MB
-
MD5
1c74d4eeebdbd04e6f9524f63b15b84d
-
SHA1
5d86aefe2e6632572b971338a5556ee8a9fc96c9
-
SHA256
0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a
-
SHA512
866761e39296f3399a8b0af6209a644a1a54e0a5519130acf0fafc82e11ec36de83c7d4b7d38f4c4606dcae0a0c745d5f2896e8109d4d5c768ecdd04cd0c4852
-
SSDEEP
98304:k4HuqlDao42RLqaw/jTLq36t+FpyhRTcKm6eAdjTvQlye2tuT/gUMlgm:zHZ2oZ+tm4+fyTTc+JTvy0tK/L+gm
Malware Config
Extracted
ermac
http://194.26.29.28:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 2 IoCs
resource yara_rule behavioral1/memory/4192-0.dex family_ermac2 behavioral1/memory/4138-0.dex family_ermac2 -
Makes use of the framework's Accessibility service. 3 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.qjlpfydjb.bpycogkzm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.qjlpfydjb.bpycogkzm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.qjlpfydjb.bpycogkzm -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.qjlpfydjb.bpycogkzm -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w 4192 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/oat/x86/base.apk.kI9Ugey1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w 4138 com.qjlpfydjb.bpycogkzm -
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.qjlpfydjb.bpycogkzm -
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.qjlpfydjb.bpycogkzm
Processes
-
com.qjlpfydjb.bpycogkzm1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4138 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/oat/x86/base.apk.kI9Ugey1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4192
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD56d66718d6b092ebaf2e08f9571dacaaa
SHA1ffec6bba6363ebfb65cb3dc21b992b3dc116c16c
SHA2562b7a055d5d48d8059ecf309f91510af3873caa1c5d5dadbbef5d15ef1dc782c4
SHA512f866daaee7ca1fa4edef60b4d4794579f1aa7fffd729294ec0ca64f4dac950c5ad786c7e425fedcd75401eecb5636060e7fe7c440342d4e947dff7f870d92dfc
-
Filesize
1.4MB
MD5b6743ab0c201878d1af5f0343ebe8fc6
SHA101300063b5906c950eff077f3ce980ecefa048e9
SHA25636d11490991e9ec4ca3697e80b83ecca02d4457b71c5586531298766cf7ba8a3
SHA5124f2801d8ca40def3013175fd08ad1a7cb6bd354397c3bcf0aeba01abb11d6189673c06f82e1808e7415ef55018120e31574e9e419baaca71f18e84e6db51a3c8
-
Filesize
306B
MD597c6d0b4ccd3e898d1141a179fe2a479
SHA1b69525c8a5dc96e32f7424138a1369577922075a
SHA25613548b8fc5295a0a5dc46b9a392a083343c41a2a291eea22f4ac72032dc844e6
SHA512abb2961f4e13359669c98a7063cf0953db649ef165646db4baa6096db1589c04cea66d0927668bd0c46b8d342d5daa767f0e3ed05f18f64c4dee18d3a90667ed
-
Filesize
136B
MD56cfa8b67e515d52630433d8c10ab2384
SHA1c872b36e27c8898c3987cc06593d429ea078725f
SHA256679a557dcf4e6a85f851d92a1f6e5f3c9244c1169ae24f99086da95c69b50cd9
SHA512f46eb8374ba84246a226e96069967fc8dc035530b1b7ad192894fc82389dd572461ec85bf4f09d945422267b53bc9fa7d7f35cf99b604e6fe057e92339bba83b
-
Filesize
191B
MD5034192fa73a3203c2bce4d5e31ce191d
SHA11a6aa3e31812e74a15e112cdfb706def366d9ec7
SHA2567844c83773d4f456b1a2cacc1efddb3091494021fecb1153fbb1143fe8102202
SHA5123371e0c8b3bc7a0bd866e6b199f7b43f0af77c8573abb3cb767321c7da73a970c7bf52d636e616695687280cb53ca49c45c0bf4605f9ec5588ad2dad5d913c2e