Analysis
-
max time kernel
1927951s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
08-09-2023 03:46
General
-
Target
app-release-3.apk
-
Size
911KB
-
MD5
94e226528cbae145be1e568e5594588c
-
SHA1
d35e5f56544e39febb6bca4aa7fc095a4f801258
-
SHA256
1d8e17c649fba3c585dfd7d64fd647c7084d9c0abb0cd84182827743f6f7dcb5
-
SHA512
e5f004cc1035f126f980bd34c3293b4991b9c462591b6930f708befd0a8ba7097a1f1ac44cb5407c0796b618c325e27685252f207a25e73200f5de63a6ea8d8b
-
SSDEEP
12288:lmP7fUK/nQMualUK15GqhW7FKhudf+u+zUf130RnPZQ1oQUp3dSklK0EZvgA4qD0:wPjUSQMulz+zXnPYoXzSk00Ivg/kf/c
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://82.147.85.84:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.zolurutekofi.tocu1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).