Analysis
-
max time kernel
2339988s -
max time network
153s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 03:19
General
-
Target
802ba42672fccf2f39b59286b9db482c311804642b071750b707dfb0f2ff2ccf.apk
-
Size
978KB
-
MD5
7a25e529d832b6ad9c0990f667d92e07
-
SHA1
aead368fbaef6c357bf865385ecea165b386f58f
-
SHA256
802ba42672fccf2f39b59286b9db482c311804642b071750b707dfb0f2ff2ccf
-
SHA512
2f090b0d2e9c379324267f9ffcb12faafeea8b8147d3b683409517d7112a37c322ce722a559c584b04c52a8ff41faf2aa0def584cc342c92385e4cc33ebe7d9d
-
SSDEEP
24576:oI8PmXXzHK9IFP+AAyjhFocy0Qi0MegS5UZ8:H8Pm+IZ+AxFaPgSW8
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://194.26.29.28:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 2 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.juvuxazuhawa.vuweju1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)