Analysis
-
max time kernel
2269596s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 00:19
General
-
Target
739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb.apk
-
Size
2.2MB
-
MD5
366134f007de0bede5afb773774c4064
-
SHA1
62bec235f1067baf34a0d0b93dfb63e554e65071
-
SHA256
739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb
-
SHA512
11b8f919c2a2b92d3e8d48a4f586bf5c13123e976bb4980372f80d57bf43b65e8fdd04e69f4cd1c3a293da58c69cc7d4a0fcc4b4cdb5fa4f521f54a0011caa1a
-
SSDEEP
49152:exu1Da69wU3VYuxhVCrvSU4fqrHvQBTR1oGiMl0:0uDauwUFYWh/UbvQBPoh1
Malware Config
Extracted
ermac
http://193.106.191.118:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.majosiwuxexeku.poniva1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD5c8dd7c66784ff7c7a55a0f018d5ba5e7
SHA1f848b1a001bbc32709b6b229fdb460274d161167
SHA2566243db51ab4a20ce9c8c5c59235347094c222e162944ce0b0958177c24f81f71
SHA51233ba5c2c642deabbd306d80530499545148f2e2b14d8599fe4e986709990cb1a301bff6f0b11ab4ca33b59cf04036b3e8427dd85e6847d231a3b0e5188a8b90e
-
Filesize
456KB
MD51ca700f9965eb02a4994ecabe13abdef
SHA1637b3a9057ef68d7be2eb3ba3650058e232c07fe
SHA256b251f5abb6a9f0ff6b4e8db24716cf4a164904a3f0690c373af8fbd0ddb3300a
SHA512ff2cbe43ff3fa6f1dc4ebbf713dbd9f9740a8e8fed64f6210fd1bbcf9a7a6e859b3cf5f064360d6262bb1d806f5c39abc2682574fac60fa2a5f8c22f024034f4
-
Filesize
649B
MD5936b6f3c65c0c77b67fa58ffce876d2e
SHA1bbb9887e456f20eaca056f5e28cce6b85960ec7f
SHA256cb9cc69ed174cc94c8656e9b5642ce152905b304ccad55023a54dd44523957bf
SHA5124007d0f3a638d4878e59940fe2118b1a93529cfaba44887eac345a5488bb9ee3de7498baf60ded81d77f8cfb96541dd7a2debb795b172b0ad550f3aae09262aa
-
Filesize
899KB
MD52bb06ce0b418fd54fa36013d131be94d
SHA1a6ee5722c0d0c0dce1d3524d29aca334588c509a
SHA2562e3a210d1821ff63420c1018a7598e321b021c4a9e85661b8d6714c4c379b75b
SHA5126de4702b7a2e381de4a368e814fe6c3251d1b90d8ccc9753bd50991205cfbc7832eee158a2889f3d8f861edf0ebe9d6754af1851faafab69e1ab32e50e5e53ec