Analysis
-
max time kernel
2252899s -
max time network
165s -
platform
android_x64 -
resource
android-x64-arm64-20230831-en -
resource tags
-
submitted
11-09-2023 22:02
General
-
Target
b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3.apk
-
Size
3.7MB
-
MD5
fd9bc14fdfc21de632d363a80b4a69b3
-
SHA1
4b7207e591ec14e255ff6e4615226d6bdf5fb9d1
-
SHA256
b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3
-
SHA512
c862f82b29ec22969de6990fd4925795efd8dc597a0c1112856c904480e1604948f807d0e4e5f531bdd7c457cad609af9c671a0075b8e8c85904c9aee0016764
-
SSDEEP
98304:sUrHmTErDuO/KaWKRN7r311AjSNSjJ7Xs0PF5kSQPFfEJ/g9uMkNsy:sUaIVN7r3118S4jJXsAF5SPFMpB
Malware Config
Extracted
ermac
http://176.111.174.191:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 3 IoCs
-
Makes use of the framework's Accessibility service. 3 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs
-
Removes its main activity from the application launcher 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the unique device ID (IMEI, MEID, IMSI).
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Removes a system notification. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.urgerdaao.dwwvbcows1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57d78eb73d37a41fcaf79bd265fddd6d5
SHA131a72a2cbeff48c3049d537bd4eaa0823505a12f
SHA2564fcb0e56a4dd1375faddf358f9bd64b02dcb8b644a67a28e04e59ca52a640b93
SHA512ca320f194d1e32c66f387d8ad549014325e4d1f062d1871df13a6d0598c404d53bd02b9b47b36e37b7185dd7d95901fb8ec84a91bfe129523395e4660f315ccf
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
1.3MB
MD57d78eb73d37a41fcaf79bd265fddd6d5
SHA131a72a2cbeff48c3049d537bd4eaa0823505a12f
SHA2564fcb0e56a4dd1375faddf358f9bd64b02dcb8b644a67a28e04e59ca52a640b93
SHA512ca320f194d1e32c66f387d8ad549014325e4d1f062d1871df13a6d0598c404d53bd02b9b47b36e37b7185dd7d95901fb8ec84a91bfe129523395e4660f315ccf
-
Filesize
1.3MB
MD57d78eb73d37a41fcaf79bd265fddd6d5
SHA131a72a2cbeff48c3049d537bd4eaa0823505a12f
SHA2564fcb0e56a4dd1375faddf358f9bd64b02dcb8b644a67a28e04e59ca52a640b93
SHA512ca320f194d1e32c66f387d8ad549014325e4d1f062d1871df13a6d0598c404d53bd02b9b47b36e37b7185dd7d95901fb8ec84a91bfe129523395e4660f315ccf