Analysis
-
max time kernel
3610959s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20230621-en -
resource tags
-
submitted
08-08-2023 22:11
General
-
Target
1c310cd242a87be5cfc15ead92cbeccadd3d14de3a03fb043286ca11c8afe05d.apk
-
Size
3.3MB
-
MD5
4ad2a756156f9d674fcb21fff2fd37ab
-
SHA1
5260cb40dc651def5a8c265acdbadf6230a06e83
-
SHA256
1c310cd242a87be5cfc15ead92cbeccadd3d14de3a03fb043286ca11c8afe05d
-
SHA512
58a3c08fd315a430360859a6c7a1bc90f4c943ff8802e2285c289edfeeb7540217aa64f92a3cdc65f2683a443f1dd96ef8accfea1f852ed27045e7107530e426
-
SSDEEP
49152:aMQHcdO/rcUbk5wX1hAqYax8sTH30OQfD4fY7DvgJXCgcuHZnOmW9ihOeS/Pu:aMQDoSeqYax3EOe7DIXCRspOP9yS/G
Malware Config
Extracted
ermac
http://91.213.50.62:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.xemitawitapenu.ninoso1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
MD5c6f4657e0f6c25aad875055cb6d00394
SHA1d0193b09d5833973a2ed30b31cbc412ba29da1b2
SHA256977347e4a3829de61e9b566ef66c380093f6c606955f0dea7574d2044fe76d9b
SHA512dacd01794b379364e24df8d566c5ccb8ab194662b0f32e6dc50086a7d33f1f56ce915ea131552f0385000c8abf85073fc55425c7d45fdb244f2b8aca1513850d
-
Filesize
1023KB
MD558c2b26dd2b220b55f32dab0b7733849
SHA1a898eeeed3ab0006eeccdeb26c4b0cb8927b0892
SHA256fab5de97fb36eb6ef199fcc4edb004163109b344a76ff9054c799dc4dbf65ad9
SHA512947cda664ed431f25bd1b071e43b056dfa8eb90e510279a8cba8666a15cb35d25ded3389816c129c6903205c6e7cadfdc0dd6a120efb7762797ba921dbf4bc1d
-
Filesize
138B
MD5a3f99540572fc7fc7542b849ac201e3a
SHA138a556b62914f30934905cbbdcd7a632134be1a9
SHA2561b846f5238571dfb29e5b2291f826f065d92346848582c2a2402cd8a2b52b2ab
SHA512ce644a41bf1830f86390779de04f0ca1db8145a24e1064b19d1d9cd23cf74c33a251cc3ce0527005812cc78aec8b27eae16cbf3d09a99854c136d1cc85d9f488