Overview

overview

10

Static

static

7

4bc5c2a68c...cd.apk

android-9-x86

10

4bc5c2a68c...cd.apk

android-10-x64

10

4bc5c2a68c...cd.apk

android-11-x64

10

template.js

windows7-x64

1

template.js

windows10-2004-x64

1

Analysis

  • max time kernel
    2277564s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231023-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231023-enlocale:en-usos:android-11-x64system
  • submitted
    31-10-2023 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4bc5c2a68c50c8c901043228e9f894c5505decf283b4f4f3f6afb68c8ad260cd.apk

  • Size

    2.6MB

  • MD5

    8b76ab0c85478eafe3b75af4c7a925b7

  • SHA1

    18e8a50a7578797f2ed879ab392663ce67280e0e

  • SHA256

    4bc5c2a68c50c8c901043228e9f894c5505decf283b4f4f3f6afb68c8ad260cd

  • SHA512

    f0c2b2f2d060845b4db0629a6d6e06cd291e91082c55258ab487c7773565e3b019927339f62b7aaf246bb41cf3009fd808d2bc8e2fa031f140dd7abcbd24bbd4

  • SSDEEP

    49152:mF+l6owv4Jbplifg8P3Xgk+TygLjCFHnrNOlB4yp/uG7/CK:S+kL4JbplS3XATyCYnrMlBP/RzB

Score
10/10
ermachookbankerevasioninfostealerransomwarerattrojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.bulosinehipibe.zusu
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4515

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json
    Filesize

    675KB

    MD5

    a58e4ed5192672222fb3254445186ca7

    SHA1

    839285dfde1bb6de7c48047bed79637f4772c6e5

    SHA256

    1fee256809f1ab1be46910668b83e1a2d15d7526d0fe3648ce395d0505ac923a

    SHA512

    58942bf96cc16a978bfd5d1b776f89d5c5e76d476df091394d889657f5ecc9a1d187279a3749017c0759f86c16414ec0d939ea39ff45504b53416ef266b8b88b

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json
    Filesize

    675KB

    MD5

    8d17f68b305036465f27cae5b5585bfc

    SHA1

    eff0501ca441e60b5b03e72fdbca44a591f6573f

    SHA256

    3cd9b04b986c3cc64f50b51cbf5b006f5664938176c444d828db7150892ac8e0

    SHA512

    2b29a38c58121ec81e4e6d2b606005f7a16801514d91ea23160babc41824882bd381131c2bfd1049dca397c2492c52d628c8ae279aa3cb4efda63cce03f133e0

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json
    Filesize

    1.5MB

    MD5

    10ff6ba09437aaf043f3001eaa5e11ee

    SHA1

    0a67debe9d2053ca265b8ca84713e15f39c73638

    SHA256

    9c79a22ecf75ee430c297f981bada888f825eb070339221c7febaa4ef197e2c8

    SHA512

    e28e385ed87c70c50c87f4377409b1e0546cdb29f16c350da3fc418e2c55739813d9c0421c6b053c7b3da54b76d1da5d5afe73495978e0379b48038468d45477

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    5561de843d8239f5a8533e9cb2fe09d5

    SHA1

    28186ffa3080e3249c8cd881208b4ad29a942f4c

    SHA256

    3be550fa66e5c73fb2a4ffd6c8edbdb9020d2a08a8d8fff998807df3e4229d9c

    SHA512

    3bab2dc1b94ec2384184f9776970157fee108c9c44ba4e235eb1ea6662de7bf5e563e1c2d6b58e6eccaf3239d56ad0d9c93762bdf92839f805afbb5ab410dc32

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal
    Filesize

    16KB

    MD5

    38bbbf32d5f380fe94e257b03d7550c2

    SHA1

    6a4b3c2e354fc47c014181402a78aba67b5ea792

    SHA256

    bdd4bea7fea682abd47b7230e2a1774fbb195ae0b6ebd27e53427901c1a7524c

    SHA512

    623b24263174aaf079e2f36c1cab38d008981e825a29531f018281c2778b4d76ae6d4d536609dab7ebbbf66480e572140c3dc95329a9bb16152da973d27f24e4

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal
    Filesize

    108KB

    MD5

    f6f148c42972b552ea4c25a8e3032aed

    SHA1

    ee102c62b28314a2fabb904fe0a0d627472f1d7e

    SHA256

    96fb6c1b465bf81d5591b85e0324d3c791190405907a1b9ecd457b128c228669

    SHA512

    0232cf56afd33dca0c47657465927c88f9fd1900bc86f11bca9bd2f5068ed26709a9d63f2ae62c52352a79b69cca8c96009bfe454e12ee7bcffc914101ca50be

    Download Submit

  • /data/user/0/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal
    Filesize

    173KB

    MD5

    f8594815bb367a9407d4eaa4d2295cc6

    SHA1

    a957431e70113ea033258894cb7a6bb426f9a2d5

    SHA256

    48216784f0d98b67fca4c640a0c6867d10d1c7fbdd685e18df3e9f97779857bc

    SHA512

    9a22b5ed3e79282af39ffb07d40945f289ca3636d2ab1892eb39271477f12e4160cb63184295b9158dc71372a99cbae4f7fdc1453ca00bb95cc8d7ad3028d842

    Download Submit

  • [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json]
    Filesize

    1.5MB

    MD5

    10ff6ba09437aaf043f3001eaa5e11ee

    SHA1

    0a67debe9d2053ca265b8ca84713e15f39c73638

    SHA256

    9c79a22ecf75ee430c297f981bada888f825eb070339221c7febaa4ef197e2c8

    SHA512

    e28e385ed87c70c50c87f4377409b1e0546cdb29f16c350da3fc418e2c55739813d9c0421c6b053c7b3da54b76d1da5d5afe73495978e0379b48038468d45477

    Download Submit