ermac | 7e056d2979bb1aaa5cb13a8b0be661cdd54758345728d489ab792ed00aea36e3

Analysis

max time kernel
2301104s
max time network
140s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20-12-2023 02:36

Target

7e056d2979bb1aaa5cb13a8b0be661cdd54758345728d489ab792ed00aea36e3.apk
Size

1.0MB
MD5

e81530e09c6f374c4f16d11d1f3507b6
SHA1

1298b3bea184ba8339e1417ac0088db8d62451ae
SHA256

7e056d2979bb1aaa5cb13a8b0be661cdd54758345728d489ab792ed00aea36e3
SHA512

ba69da9bb2439965d56fa448bb865491cf3a6efc0da4d820d155cbaf222a9502279b71a7f25b9dacee09572f24b968455c669e54cab23c2893634eb2e642f5af
SSDEEP

24576:0yVfuXy1Ne9c+Paq2VPkMzbXeQ4vcp3wYBgS7UnVuA:0yVfuXy+c+ijKcp3hgSrA

Score

10^/10

Family

ermac

http://194.26.29.28:3434

AES_key

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.nefibikobomidohi.cemoze
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.nefibikobomidohi.cemoze
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.nefibikobomidohi.cemoze

Removes its main activity from the application launcher 2 IoCs

pid	Process
4984	com.nefibikobomidohi.cemoze
4984	com.nefibikobomidohi.cemoze

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nefibikobomidohi.cemoze

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nefibikobomidohi.cemoze