Analysis
-
max time kernel
2252890s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20230831-en -
resource tags
-
submitted
11-09-2023 22:02
General
-
Target
b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3.apk
-
Size
3.7MB
-
MD5
fd9bc14fdfc21de632d363a80b4a69b3
-
SHA1
4b7207e591ec14e255ff6e4615226d6bdf5fb9d1
-
SHA256
b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3
-
SHA512
c862f82b29ec22969de6990fd4925795efd8dc597a0c1112856c904480e1604948f807d0e4e5f531bdd7c457cad609af9c671a0075b8e8c85904c9aee0016764
-
SSDEEP
98304:sUrHmTErDuO/KaWKRN7r311AjSNSjJ7Xs0PF5kSQPFfEJ/g9uMkNsy:sUaIVN7r3118S4jJXsAF5SPFMpB
Malware Config
Extracted
ermac
http://176.111.174.191:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 4 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Removes its main activity from the application launcher 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.urgerdaao.dwwvbcows1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.urgerdaao.dwwvbcows/app_app_dex/hgefstv.qjv --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.urgerdaao.dwwvbcows/app_app_dex/oat/x86/hgefstv.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57d78eb73d37a41fcaf79bd265fddd6d5
SHA131a72a2cbeff48c3049d537bd4eaa0823505a12f
SHA2564fcb0e56a4dd1375faddf358f9bd64b02dcb8b644a67a28e04e59ca52a640b93
SHA512ca320f194d1e32c66f387d8ad549014325e4d1f062d1871df13a6d0598c404d53bd02b9b47b36e37b7185dd7d95901fb8ec84a91bfe129523395e4660f315ccf
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
1.3MB
MD57d78eb73d37a41fcaf79bd265fddd6d5
SHA131a72a2cbeff48c3049d537bd4eaa0823505a12f
SHA2564fcb0e56a4dd1375faddf358f9bd64b02dcb8b644a67a28e04e59ca52a640b93
SHA512ca320f194d1e32c66f387d8ad549014325e4d1f062d1871df13a6d0598c404d53bd02b9b47b36e37b7185dd7d95901fb8ec84a91bfe129523395e4660f315ccf
-
Filesize
1.3MB
MD55feb4c1d657d56501c21847db1a60956
SHA1ec9920e2a1cd2ad999ef3021c8aa7077d7751c51
SHA25602b802c371d21fdc1d1046784a0693a88c1ac21b023d055cd49f6c69d770ea50
SHA51220feba35e9cdd07ca3aeb13bb113c5dabd1f4b2bbca7321394d720161c84e37a98c1038dd53b36a0ebd2d673c4cdda89f4bfc22b5eb56b719f6a192b2435303d
-
Filesize
1.3MB
MD57d78eb73d37a41fcaf79bd265fddd6d5
SHA131a72a2cbeff48c3049d537bd4eaa0823505a12f
SHA2564fcb0e56a4dd1375faddf358f9bd64b02dcb8b644a67a28e04e59ca52a640b93
SHA512ca320f194d1e32c66f387d8ad549014325e4d1f062d1871df13a6d0598c404d53bd02b9b47b36e37b7185dd7d95901fb8ec84a91bfe129523395e4660f315ccf