Analysis
-
max time kernel
2529612s -
max time network
142s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
20-12-2023 07:22
General
-
Target
8f2069c23fdfb62ab637f746854a18cb068f52da38bc06e95a7cf2ae07a907ad.apk
-
Size
978KB
-
MD5
c112d68f92812ab0d8dfcb105cc7658f
-
SHA1
9c52011ac19d6acf8c044bfa09bc32dfa202233f
-
SHA256
8f2069c23fdfb62ab637f746854a18cb068f52da38bc06e95a7cf2ae07a907ad
-
SHA512
e3ff2bfc6e8b3357f3c76528b51850497b014bbeec4899dac4d424534e52813606fb2c375aa9e94a15c8b113b698cb0d02a79eec01470d150ffa5376e1c868a9
-
SSDEEP
24576:GTO1XXkclB8C5P4sAcxN+UiEJics5cgSCUKX:GaBkclB8C5zA8UAgSW
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://194.26.29.28:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 2 IoCs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.yajaluhovate.lewexibe1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)