Analysis
-
max time kernel
2267464s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 00:16
General
-
Target
72db4b6b4d90f66c099e4366c91cabc076d4ba5968abd163a9b61f9c9ea288cc.apk
-
Size
1.9MB
-
MD5
c7f59cbbe28d2b022dfbabdbad23160f
-
SHA1
7b4e800a72e0fba35096c1723f96158c06c090c6
-
SHA256
72db4b6b4d90f66c099e4366c91cabc076d4ba5968abd163a9b61f9c9ea288cc
-
SHA512
da3c7ef32deb849edfc52ebd1cd1fb7c9b38d5e99851f4eb3076a5ce212d6707c35c973f9e1f3e3ec0d7652b37f5a2a52d16284f4dabc5e6cdf7fdccfd7f2b71
-
SSDEEP
24576:mGF+dxOtkCRswHXCqqRb54XPbsvty4fUjlDPSYj4cwbcAfAO4h+pKvfEHIAG9Zeu:/FQOKyiqYIzSy4fWspQnE148AfEG
Malware Config
Extracted
ermac
http://213.226.123.8:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.yuvutitoyece.kevara1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD546f260e25dbf773e4435b0d448c67317
SHA12133ddf28f66d3736d3e565519a223ef2d4f8bc0
SHA2565b6881b887c2979d5811f86fed25a6d5781ba262af40b0df870d97462cdc7227
SHA512784780db097856a52a7db818ec07ac67421c5ab7e224af2a17c18ae9234276ad971f9d02b975a8c838ee87c3c0e6f288a6505fbd57acfbd3efa0a9ac36539b53
-
Filesize
451KB
MD5010709b589130528bb2eac2cf9f4778a
SHA16e7d9f9aaa2cb38f292ebc3069861dbc57ebb953
SHA256ca9ae400d0b8f41afec3bf1e4576e76b607f6553ed9e48f5de892c941988c0d1
SHA512f63a7384ed7dac859716c1375e365213e133baef0d439828a447c73a34099cd8dadc3fb312e3b0c48fb79dda750aab754379127b6616476c626e88502c453255
-
Filesize
533B
MD5d0cb47d0f088b561862a7c0a7ea2987d
SHA1a2035c1f9623966c8e8b8dfa26c435ccb1f283c1
SHA25690a3de8f8ddce824ff6c674fb96d90978f36cc09d57fde37b04593c6a45bcab1
SHA512ec8ba25645fd848369bcba2a8ef25d64e69ae58e1b7975c79e479d848c8334e9e173a276aec2586839f5c6ae229496957e51e23b65ac7f30c68d31137234b99a
-
Filesize
890KB
MD5330b52c434924c3385b3a529e03d1803
SHA1d24b432a00c6721d4b3c72e3a10c9bc5d191f179
SHA25603ec8fec34c20bfdc2feeaa94b2dc88db63f9ba69358d078a62c0eae2b727aeb
SHA512e8d2cc68874b31331c44ee4e5d475c0ce31eef6981cf34b1d7bf2f6d02382be88043f7779e4af9750f5e39ccb397af3a67203ea4dce7e9b2bc4812b76b254815