Analysis
-
max time kernel
2414666s -
max time network
170s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 07:53
General
-
Target
912c4c52e1d61021a098d93e4c8fcfd440e368c7ed60cc6feb180a993370412f.apk
-
Size
4.4MB
-
MD5
3711fd47766af210965dfd48329385cd
-
SHA1
a7cce8953ef22f62dc8f0948b90ef038b8c6a777
-
SHA256
912c4c52e1d61021a098d93e4c8fcfd440e368c7ed60cc6feb180a993370412f
-
SHA512
c73bc4830f21d40483ccc545068c5406b01af55ef1fd2535450b1d2f80009505d663b6d1f5750b1b43c942970afb61e5f45afc9d364aa53d95d5c75b612a962a
-
SSDEEP
98304:P9tO+8QPTmJJvqhfSYF4f9yLtvp0DtfJLdvP7lcNuBH3SMWdu:PmECmlSYFOAF6fJxxchMWdu
Malware Config
Extracted
ermac
http://194.26.29.28:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.lcjoxpsju.bpevqsbzq1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
757KB
MD53be6c135e768401db0938413604e7c76
SHA1f5a425adfc9b4f08eefebf4e25b038a9ba4ef240
SHA25694c5ef95ff5d68ee2c805fb9b1e6132f7e30ec063690a2ad0673ec4181f0484d
SHA5120ae4a2c431b34fb2d123d94db614ae30edd348eaba7ce07b6659ff5d277d671cb0efbeba07f91846dc3b00dd773835620fb01c8f6d4f1461bb22bda14d680e22
-
Filesize
1.4MB
MD51724a91975dbe7489ec702aa38e47657
SHA1846147a020bdbc6932f96c3a38ac38b30c763f10
SHA2560abfb54a654631e92b7921390b49f9369530e371848a4f4f599aaebb1bbe938e
SHA512503edec4bee491f79f1a1019fa5afdd8e3a1ae9ee760861ad2e43b407d2c684ffce8f516b967996f24fb1faaab9ee32b68c23dcb8be976e39ad84466bc0a5868