Analysis
-
max time kernel
1927954s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20230831-en -
resource tags
-
submitted
08-09-2023 03:46
General
-
Target
app-release-3.apk
-
Size
911KB
-
MD5
94e226528cbae145be1e568e5594588c
-
SHA1
d35e5f56544e39febb6bca4aa7fc095a4f801258
-
SHA256
1d8e17c649fba3c585dfd7d64fd647c7084d9c0abb0cd84182827743f6f7dcb5
-
SHA512
e5f004cc1035f126f980bd34c3293b4991b9c462591b6930f708befd0a8ba7097a1f1ac44cb5407c0796b618c325e27685252f207a25e73200f5de63a6ea8d8b
-
SSDEEP
12288:lmP7fUK/nQMualUK15GqhW7FKhudf+u+zUf130RnPZQ1oQUp3dSklK0EZvgA4qD0:wPjUSQMulz+zXnPYoXzSk00Ivg/kf/c
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://82.147.85.84:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock. 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Reads information about phone network operator.
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.zolurutekofi.tocu1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).