Overview

overview

10

Static

static

7

3077d5358d...52.apk

android-9-x86

10

3077d5358d...52.apk

android-10-x64

10

3077d5358d...52.apk

android-11-x64

10

closebutton.html

windows7-x64

1

closebutton.html

windows10-2004-x64

1

core_wrapper.js

windows7-x64

1

core_wrapper.js

windows10-2004-x64

1

help.htm

windows7-x64

1

help.htm

windows10-2004-x64

1

help_cs.htm

windows7-x64

1

help_cs.htm

windows10-2004-x64

1

help_uk.htm

windows7-x64

1

help_uk.htm

windows10-2004-x64

1

license.htm

windows7-x64

1

license.htm

windows10-2004-x64

1

mraid.js

windows7-x64

1

mraid.js

windows10-2004-x64

1

omsdk-v1.js

windows7-x64

1

omsdk-v1.js

windows10-2004-x64

1

playstore.htm

windows7-x64

1

playstore.htm

windows10-2004-x64

1

privacy_cn.htm

windows7-x64

1

privacy_cn.htm

windows10-2004-x64

1

totalcmd_d...ng.htm

windows7-x64

1

totalcmd_d...ng.htm

windows10-2004-x64

1

totalcmd_p...cy.htm

windows7-x64

1

totalcmd_p...cy.htm

windows10-2004-x64

1

wifi_rc.html

windows7-x64

1

wifi_rc.html

windows10-2004-x64

1

Analysis

  • max time kernel
    1240832s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-20230831-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20230831-enlocale:en-usos:android-10-x64system
  • submitted
    19-10-2023 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3077d5358dfadec5956dd3db5a28c4e416332c5a4d44deb96b3fccc907f18452.apk

  • Size

    2.7MB

  • MD5

    54f85f012dd01b28ba3b8b5b71637709

  • SHA1

    8a4e72cb1ae1ccc9a155d4cb7e4d7476f64d6918

  • SHA256

    3077d5358dfadec5956dd3db5a28c4e416332c5a4d44deb96b3fccc907f18452

  • SHA512

    3ac0254f808465a853ccbd5ab289bc456253d522896fbceacddf5f7ade645c842d03373857b83b69289d2f70775a639ffcc6729f3f6e4cc6a59a6d9c81352e6e

  • SSDEEP

    49152:sbSAO1Ah8i6uzPXVzg84H76Fg/fw/pQdUYl/LTPy+BRo1JbG0:9AO1r9wPXVWH76FBpQaC/1BRoS0

Score
10/10
ermachookbankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.xadayamuluceti.sabixu
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5069

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json
    Filesize

    674KB

    MD5

    ef47cdab541a17542f9c256500f88673

    SHA1

    a57335900b6932306ac287b593b91ac8cd7613bf

    SHA256

    09766f2d5d5a2a2393234a2b95a196e8a0be29f5c8837cdd2699b6b569bdf512

    SHA512

    ef8a9159122e0d635d14a803c0ff361b5c84fbc5c2f8c1e4b90e75419bc435888aa9ae92eef96c4e08907b149c4934033f8dbe0d06d3afc0109d8d60585c0258

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json
    Filesize

    674KB

    MD5

    b9b389274b78ec025e203efb985acb81

    SHA1

    24444570b38533f2e1c5f059b3ae144321d1f768

    SHA256

    ccb013d8e1ce0ca69d6c8c19a43af771e56c2ce332c28b60a5c7bb4abddd201c

    SHA512

    854b1522998b4bae345eb5db691bad0f1a87de44e7e548a6dc8c1872f4ec51e2fcb073c98c9b6e3c4a25ac64cb18efc2d1d74a45a911015ed9c6ba3af4030e68

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/app_DynamicOptDex/oat/HFhXsL.json.cur.prof
    Filesize

    3KB

    MD5

    2e6ba61d8ff63d58e5846889e19b2d15

    SHA1

    2c5925b92cfa58a3ef2e95ea569d5d86fdf6db94

    SHA256

    3cb35d76cd770da043d061b4eff501bf51cce19a95fd2fe28f013ef1e04ca5f2

    SHA512

    2ab8f078dc0077422470ce11819f52e641dca0720f2cf2106b498cd672e5695470942096b5a5836aee8f947df407ff6404f9461d025ba1a5871499546c60d4f9

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    546d14bb6e8238d46296a1186c396dca

    SHA1

    74112e08cf8b1455bbb27e9585eef77619bec631

    SHA256

    93feb2d044ba5dc3b75a12505552db7b088913d1432201582c45aee022dec277

    SHA512

    e492ee6922da288496c8405113ae98240ee265bf66b4d807337887754694242213787d434b661818a1ffab8dc480c36de6899f154c44342708602dc274762b83

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    bc58b09b9f0e564745b3f5d8348340b2

    SHA1

    79ec2f1e9ec5a12a8aaec855dc1e3a06404f9387

    SHA256

    38ef2bf7bfbd1bb98a842140bc56ba2a51ac30be717fabe9c81d92057c09bbb0

    SHA512

    c6e2c83d878021bb2b4ef12ec8ba3e007d8e295879dbf38cb7f680964d9749d253ccb8c1db46d5721065c6efaa70ce61084694ccd758bd4b8e3ba3641f17240b

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    133e0039bbd91f1c08e8795f5d7dda21

    SHA1

    b5cb0863950b7a1d8f46a117ebd7a6f51d9d7317

    SHA256

    68972816bc7196875014d60806b562adb44ce95546b89a53cbcee487cb989948

    SHA512

    af028d05c763923e9f363bf5d65d34ab4fb491113ce7b2644c98197f6661f6e5330a0b15be1b80c2ec91af0bba995b2cb67dbb573bf9ccb5d2428e81ca940080

    Download Submit

  • /data/data/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    3ea83d382bdf1c98d5cb8e11e8d56b67

    SHA1

    af31da45c010e6dde72b6e7f7a369cfd11a3098a

    SHA256

    f3e3de9ab900665e2b4c3e100685ac94314db83dc7d8d34fb5652718b8679140

    SHA512

    177ebb4a15fa88942d33808c5a43c1ce04508dac4827e0438cbe074008c02c4ffccea7db8a88f194043a4018d28d14ec5c4553153fe67f42431a357c070a5b75

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json
    Filesize

    1.5MB

    MD5

    77dea45c30ffabf3ff6688d62fc73366

    SHA1

    80b6c2bd5b759dad4a2d9ed57420f0408a6a1d5d

    SHA256

    4d53e5a2688f9b4bab76142af98524154bf3bdc5de3bf98455a8f157999edbf7

    SHA512

    4a1afdf64514215602361bb51c0eb6a505945b3764e26092ce0007a29ce5df317851af2c781d2b0d955e7e29275344fc7b1afbd25b7db20b8cfe6eed79428c30

    Download Submit

  • [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json]
    Filesize

    1.5MB

    MD5

    77dea45c30ffabf3ff6688d62fc73366

    SHA1

    80b6c2bd5b759dad4a2d9ed57420f0408a6a1d5d

    SHA256

    4d53e5a2688f9b4bab76142af98524154bf3bdc5de3bf98455a8f157999edbf7

    SHA512

    4a1afdf64514215602361bb51c0eb6a505945b3764e26092ce0007a29ce5df317851af2c781d2b0d955e7e29275344fc7b1afbd25b7db20b8cfe6eed79428c30

    Download Submit