Overview

overview

10

Static

static

10

GoogleMaps.apk

android-10-x64

10

GoogleMaps.apk

android-11-x64

10

GoogleMaps.apk

android-9-x86

10

Resubmissions

15-05-2023 13:44

230515-q16n6sea6x 10

02-08-2022 06:20

220802-g3t9gsbgh3 10

Analysis

  • max time kernel
    531262s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    15-05-2023 13:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GoogleMaps.apk

  • Size

    907KB

  • MD5

    ea449f22d8dd8d8fe8732dd96d69cb99

  • SHA1

    d0656d504fabddb0bccc284976120e1a8299dcde

  • SHA256

    16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a

  • SHA512

    0da0a54de3cc28d3d8f8e44748aa2359f048f4c21d319fb2941bd2b4866bb53abdd857b5f27a346daa5b7f79b9a68af89baff598133fb8fe0c1633a820328fe7

  • SSDEEP

    24576:OlFD/teGNYj4ETDPHKDz82qBwWsmEg/WMsa:KzNYjVHqDSsmEg/WA

Score
10/10
ermacbankerinfostealerransomwaretrojan

Malware Config

Extracted

Family

ermac

C2

http://193.106.191.121:3435

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.ceveluriseze.xuca
    1⤵
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.ceveluriseze.xuca/app_webview/GPUCache/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/app_webview/GPUCache/index-dir/temp-index
    Filesize

    96B

    MD5

    d98cd9b30bdb3c29bd046f4f26e0416c

    SHA1

    f1bb7b1fe649ed8316a9b80a14bc6463f6e19899

    SHA256

    f4b76be811a246c935d22c5737cbd1e6c1d5eb7a492265121752e0effadadfe3

    SHA512

    7b4a1185454e3e02bec287ef14de9eb4589d86f0867f84def0f82d601c7b6243b40cec5be192bce1ffdaf822f9be2ece9e1216e416d7c9beeb615211521b0251

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/app_webview/Web Data
    Filesize

    112KB

    MD5

    b663831f8cc130493476d94f2d7a5330

    SHA1

    043a1956ab8e40821d67043f8a9110a8eb36fb93

    SHA256

    c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

    SHA512

    e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    1964b309a132908a91bf093394e0fef9

    SHA1

    2b69fdc6ea3df53af69e6fa8e219c8add2e2fb0b

    SHA256

    11bd19a7b682daf8d29c1d5a17dae3386a683cf0ab9fd82f61f648dc8d020722

    SHA512

    1d0278ee9bc655c0d73dac391c086d64d1e0c3e117568137323dfb43d07ab96507e0cdaa6e2b92c634e88bb235652c675f414c7bbcd9c59c20940a6dbfd55ab1

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/app_webview/metrics_guid
    Filesize

    36B

    MD5

    7e1c97ad6959e73cd05b90053a6c3b5e

    SHA1

    755d55d9a13dea46116081532e917d4875dd1143

    SHA256

    92865e679c3208dfac637018b336fbd9857490a724b84be0f3de39051af8398a

    SHA512

    9c31b2972562ce53d158020ed93a7ae58882e91340e81a56cded9addffcc67e7e255837cdca35c536c37b51bcf7ee940b18fc6c9e0bad0891c76fa04695c4c6b

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/cache/WebView/Crashpad/settings.dat
    Filesize

    40B

    MD5

    e76d9417740491192dd7a31d7049d819

    SHA1

    eeab99532b4ba2128ea7f581f99ad214e50a045e

    SHA256

    02639cb44fafabb37ed1910a570cb5133f160a64d4350d4c388949a62ddb20b5

    SHA512

    035a0abff82454cc330927f1ea0feec57664c603b7b549232339c5d1c60e264ad0fdbf0ae2991547eb60a18fae8dffae8fb8fb6ec69cbb492fcd4be4f64c33dc

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/cache/org.chromium.android_webview/Code Cache/js/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
    Filesize

    96B

    MD5

    5cae2923b6e6fcdbb694ed2037f70be2

    SHA1

    e38b14a95647828d2e8d20e52389fe8212889bac

    SHA256

    15e0c34ef564ebab570e6772efa00f1bbf36ab5888561f77f5531cec02d7b85f

    SHA512

    25fc31a47884655f738b2777d0d123f73fb8c3a841c4cc174635a2bc3dffc008ddb210dd5c6e209646a216d2ed2ba447471a437c77f13fa12f1f304fc37ac028

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    6ef709b8536878951e87c29a1518fc2b

    SHA1

    24376c70b00152501b3d98df61fa7db435339172

    SHA256

    10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

    SHA512

    96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

    Download Submit

  • /data/user/0/com.ceveluriseze.xuca/shared_prefs/settings.xml
    Filesize

    134B

    MD5

    097c71d7e1d6d23a16553dd66217f408

    SHA1

    0da820259c580853394a7ee20aa0e49c69f9d5c8

    SHA256

    aba8351b1c609018bb3b627889409b4e18914942118f39545fa2ab9dd7e86d52

    SHA512

    4c4b7ab1b390fda9c50b55518fee852d52d8d2a571e29e0f04e48c0b1e564310c27ba95d7273b45168b8a59aa6fa7f25afb93fe8f5661e57184092b08f56ba31

    Download Submit