Overview

overview

10

Static

static

7

3077d5358d...52.apk

android-9-x86

10

3077d5358d...52.apk

android-10-x64

10

3077d5358d...52.apk

android-11-x64

10

closebutton.html

windows7-x64

1

closebutton.html

windows10-2004-x64

1

core_wrapper.js

windows7-x64

1

core_wrapper.js

windows10-2004-x64

1

help.htm

windows7-x64

1

help.htm

windows10-2004-x64

1

help_cs.htm

windows7-x64

1

help_cs.htm

windows10-2004-x64

1

help_uk.htm

windows7-x64

1

help_uk.htm

windows10-2004-x64

1

license.htm

windows7-x64

1

license.htm

windows10-2004-x64

1

mraid.js

windows7-x64

1

mraid.js

windows10-2004-x64

1

omsdk-v1.js

windows7-x64

1

omsdk-v1.js

windows10-2004-x64

1

playstore.htm

windows7-x64

1

playstore.htm

windows10-2004-x64

1

privacy_cn.htm

windows7-x64

1

privacy_cn.htm

windows10-2004-x64

1

totalcmd_d...ng.htm

windows7-x64

1

totalcmd_d...ng.htm

windows10-2004-x64

1

totalcmd_p...cy.htm

windows7-x64

1

totalcmd_p...cy.htm

windows10-2004-x64

1

wifi_rc.html

windows7-x64

1

wifi_rc.html

windows10-2004-x64

1

Analysis

  • max time kernel
    1240793s
  • max time network
    170s
  • platform
    android_x64
  • resource
    android-x64-arm64-20230831-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230831-enlocale:en-usos:android-11-x64system
  • submitted
    19-10-2023 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3077d5358dfadec5956dd3db5a28c4e416332c5a4d44deb96b3fccc907f18452.apk

  • Size

    2.7MB

  • MD5

    54f85f012dd01b28ba3b8b5b71637709

  • SHA1

    8a4e72cb1ae1ccc9a155d4cb7e4d7476f64d6918

  • SHA256

    3077d5358dfadec5956dd3db5a28c4e416332c5a4d44deb96b3fccc907f18452

  • SHA512

    3ac0254f808465a853ccbd5ab289bc456253d522896fbceacddf5f7ade645c842d03373857b83b69289d2f70775a639ffcc6729f3f6e4cc6a59a6d9c81352e6e

  • SSDEEP

    49152:sbSAO1Ah8i6uzPXVzg84H76Fg/fw/pQdUYl/LTPy+BRo1JbG0:9AO1r9wPXVWH76FBpQaC/1BRoS0

Score
10/10
ermachookbankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service. 3 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.xadayamuluceti.sabixu
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4603

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json
    Filesize

    674KB

    MD5

    ef47cdab541a17542f9c256500f88673

    SHA1

    a57335900b6932306ac287b593b91ac8cd7613bf

    SHA256

    09766f2d5d5a2a2393234a2b95a196e8a0be29f5c8837cdd2699b6b569bdf512

    SHA512

    ef8a9159122e0d635d14a803c0ff361b5c84fbc5c2f8c1e4b90e75419bc435888aa9ae92eef96c4e08907b149c4934033f8dbe0d06d3afc0109d8d60585c0258

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json
    Filesize

    674KB

    MD5

    b9b389274b78ec025e203efb985acb81

    SHA1

    24444570b38533f2e1c5f059b3ae144321d1f768

    SHA256

    ccb013d8e1ce0ca69d6c8c19a43af771e56c2ce332c28b60a5c7bb4abddd201c

    SHA512

    854b1522998b4bae345eb5db691bad0f1a87de44e7e548a6dc8c1872f4ec51e2fcb073c98c9b6e3c4a25ac64cb18efc2d1d74a45a911015ed9c6ba3af4030e68

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json
    Filesize

    1.5MB

    MD5

    77dea45c30ffabf3ff6688d62fc73366

    SHA1

    80b6c2bd5b759dad4a2d9ed57420f0408a6a1d5d

    SHA256

    4d53e5a2688f9b4bab76142af98524154bf3bdc5de3bf98455a8f157999edbf7

    SHA512

    4a1afdf64514215602361bb51c0eb6a505945b3764e26092ce0007a29ce5df317851af2c781d2b0d955e7e29275344fc7b1afbd25b7db20b8cfe6eed79428c30

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    d1a4a62d438c9823207f0f4f744f7b36

    SHA1

    130a6a7e437e8b253be7c44650460915d01dee5e

    SHA256

    2270fd08bbc9d23c43038bbe511ef3bf3f286953e667b817c1e85e3ca1f6e6b8

    SHA512

    d38680588d2fc0e528066618e2b8c80df65ed7211dbf484470d4e9b3d6c77d3b02835cdfb753680be608b3e7c60c49f8e1b271f0f77d198ec54a246b360e31d6

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    d08ef25e07be4b28024272e16c217abc

    SHA1

    378318255e21b8dc54fe16a2c12021491bebd107

    SHA256

    3398fbaafbeeed6669bcaf93f9b85f7eaf2e1061f859a3d75dce3921c9344fd2

    SHA512

    028a0d316fe2491810a3b8021fe004b41e9e0aa9734cdeb423d4b5ceffc9ebc4c4d2fadd0fa9a9301d7f1da3f7a86e58b11d75048fd8ddc1966428f228bfb900

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    f4bc9641ea0d116de9a6b195cf5ca6d7

    SHA1

    a0d44043ca55f01f89c5627c51f535873435043a

    SHA256

    806d0f162c3718e6d660264a81328b1bf76b67d7d2e1c189004f16109a7487ce

    SHA512

    311f421ed5fce6fd4712d89273221a95504093a4c2ca742416089ebd160eb243641300c84e1aa91d3ab0b1f0b48750198ea6031b74857423151f0e3f29dfe54c

    Download Submit

  • /data/user/0/com.xadayamuluceti.sabixu/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    36cf7581565e824cc0ed2f26bb721272

    SHA1

    97d27b34a37201c72a2f4e620cc93d568d2539dc

    SHA256

    d9bef01b8ce0c81cef102b63ae026d790fb1db9350497c33d9b44e8a724a4f5d

    SHA512

    cb742b4082b25dca76351e08f70f29400043dffcb8094aa884de03eb2d52215bf5b1511afe45c4098c9d4676fb0b9196000be5578edfcfaf51177e7e2d79cbac

    Download Submit

  • [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.xadayamuluceti.sabixu/app_DynamicOptDex/HFhXsL.json]
    Filesize

    1.5MB

    MD5

    77dea45c30ffabf3ff6688d62fc73366

    SHA1

    80b6c2bd5b759dad4a2d9ed57420f0408a6a1d5d

    SHA256

    4d53e5a2688f9b4bab76142af98524154bf3bdc5de3bf98455a8f157999edbf7

    SHA512

    4a1afdf64514215602361bb51c0eb6a505945b3764e26092ce0007a29ce5df317851af2c781d2b0d955e7e29275344fc7b1afbd25b7db20b8cfe6eed79428c30

    Download Submit