Analysis
-
max time kernel
2269605s -
max time network
153s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
20-12-2023 00:19
Static task
static1
Behavioral task
behavioral1
Sample
739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb.apk
Resource
android-x64-20231215-en
General
-
Target
739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb.apk
-
Size
2.2MB
-
MD5
366134f007de0bede5afb773774c4064
-
SHA1
62bec235f1067baf34a0d0b93dfb63e554e65071
-
SHA256
739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb
-
SHA512
11b8f919c2a2b92d3e8d48a4f586bf5c13123e976bb4980372f80d57bf43b65e8fdd04e69f4cd1c3a293da58c69cc7d4a0fcc4b4cdb5fa4f521f54a0011caa1a
-
SSDEEP
49152:exu1Da69wU3VYuxhVCrvSU4fqrHvQBTR1oGiMl0:0uDauwUFYWh/UbvQBPoh1
Malware Config
Extracted
ermac
http://193.106.191.118:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
resource yara_rule behavioral3/memory/4588-0.dex family_ermac2 -
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.majosiwuxexeku.poniva Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.majosiwuxexeku.poniva Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.majosiwuxexeku.poniva -
pid Process 4588 com.majosiwuxexeku.poniva -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json 4588 com.majosiwuxexeku.poniva -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.majosiwuxexeku.poniva -
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.majosiwuxexeku.poniva -
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.majosiwuxexeku.poniva
Processes
-
com.majosiwuxexeku.poniva1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4588
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD5c8dd7c66784ff7c7a55a0f018d5ba5e7
SHA1f848b1a001bbc32709b6b229fdb460274d161167
SHA2566243db51ab4a20ce9c8c5c59235347094c222e162944ce0b0958177c24f81f71
SHA51233ba5c2c642deabbd306d80530499545148f2e2b14d8599fe4e986709990cb1a301bff6f0b11ab4ca33b59cf04036b3e8427dd85e6847d231a3b0e5188a8b90e
-
Filesize
456KB
MD51ca700f9965eb02a4994ecabe13abdef
SHA1637b3a9057ef68d7be2eb3ba3650058e232c07fe
SHA256b251f5abb6a9f0ff6b4e8db24716cf4a164904a3f0690c373af8fbd0ddb3300a
SHA512ff2cbe43ff3fa6f1dc4ebbf713dbd9f9740a8e8fed64f6210fd1bbcf9a7a6e859b3cf5f064360d6262bb1d806f5c39abc2682574fac60fa2a5f8c22f024034f4
-
Filesize
899KB
MD52bb06ce0b418fd54fa36013d131be94d
SHA1a6ee5722c0d0c0dce1d3524d29aca334588c509a
SHA2562e3a210d1821ff63420c1018a7598e321b021c4a9e85661b8d6714c4c379b75b
SHA5126de4702b7a2e381de4a368e814fe6c3251d1b90d8ccc9753bd50991205cfbc7832eee158a2889f3d8f861edf0ebe9d6754af1851faafab69e1ab32e50e5e53ec