Analysis
-
max time kernel
2280150s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20-12-2023 00:16
General
-
Target
72db4b6b4d90f66c099e4366c91cabc076d4ba5968abd163a9b61f9c9ea288cc.apk
-
Size
1.9MB
-
MD5
c7f59cbbe28d2b022dfbabdbad23160f
-
SHA1
7b4e800a72e0fba35096c1723f96158c06c090c6
-
SHA256
72db4b6b4d90f66c099e4366c91cabc076d4ba5968abd163a9b61f9c9ea288cc
-
SHA512
da3c7ef32deb849edfc52ebd1cd1fb7c9b38d5e99851f4eb3076a5ce212d6707c35c973f9e1f3e3ec0d7652b37f5a2a52d16284f4dabc5e6cdf7fdccfd7f2b71
-
SSDEEP
24576:mGF+dxOtkCRswHXCqqRb54XPbsvty4fUjlDPSYj4cwbcAfAO4h+pKvfEHIAG9Zeu:/FQOKyiqYIzSy4fWspQnE148AfEG
Malware Config
Extracted
ermac
http://213.226.123.8:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 2 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.yuvutitoyece.kevara1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yuvutitoyece.kevara/app_DynamicOptDex/NPmqp.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.yuvutitoyece.kevara/app_DynamicOptDex/oat/x86/NPmqp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD546f260e25dbf773e4435b0d448c67317
SHA12133ddf28f66d3736d3e565519a223ef2d4f8bc0
SHA2565b6881b887c2979d5811f86fed25a6d5781ba262af40b0df870d97462cdc7227
SHA512784780db097856a52a7db818ec07ac67421c5ab7e224af2a17c18ae9234276ad971f9d02b975a8c838ee87c3c0e6f288a6505fbd57acfbd3efa0a9ac36539b53
-
Filesize
451KB
MD5010709b589130528bb2eac2cf9f4778a
SHA16e7d9f9aaa2cb38f292ebc3069861dbc57ebb953
SHA256ca9ae400d0b8f41afec3bf1e4576e76b607f6553ed9e48f5de892c941988c0d1
SHA512f63a7384ed7dac859716c1375e365213e133baef0d439828a447c73a34099cd8dadc3fb312e3b0c48fb79dda750aab754379127b6616476c626e88502c453255
-
Filesize
640B
MD5413b43239e04cb8e85e843ea89e9697f
SHA115a0e8d60687c9c2718e4b52bb48a5274cbc9aaa
SHA256c154502a59178419968e7cbfc96c31efa8051971a2f1e862cb1f116420acffcb
SHA5121e8eca1f283cf85fca520d733be7ee35e5b43f4e38c2bacec65dff266972c07e1d44cb29a55ae09a2344756766032b25ca45005c2ed4a31edb1e97346c5c4061
-
Filesize
890KB
MD5c89c975466dcc5716cc844af03e93687
SHA1df6815e60ef0e6671d3263b79447feaf9a63728b
SHA256d150be17467a28882e5f35e0d408d7586ef5dcbf85d4b4453431ae1a91371999
SHA512ba4b100caae184a7e89ecccc3949c0d3481ec0ba417f820b1a265398296a39d040f73c88a4939a84d54948fb24adbdfda71b291820c857a778c110eb82252c35
-
Filesize
890KB
MD5330b52c434924c3385b3a529e03d1803
SHA1d24b432a00c6721d4b3c72e3a10c9bc5d191f179
SHA25603ec8fec34c20bfdc2feeaa94b2dc88db63f9ba69358d078a62c0eae2b727aeb
SHA512e8d2cc68874b31331c44ee4e5d475c0ce31eef6981cf34b1d7bf2f6d02382be88043f7779e4af9750f5e39ccb397af3a67203ea4dce7e9b2bc4812b76b254815