Analysis
-
max time kernel
2448379s -
max time network
165s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 09:07
General
-
Target
9a44737d1f50f976e29b5e5d2dcd20d6c177df9ad7714eea707905261647ee0f.apk
-
Size
1.6MB
-
MD5
626792edc0cd3f8e57c65e2d0af0345b
-
SHA1
4f1f32166aef396a7bfe4d6e41e25558c01e6872
-
SHA256
9a44737d1f50f976e29b5e5d2dcd20d6c177df9ad7714eea707905261647ee0f
-
SHA512
bcd8841170bcd21cc1f5efba444b69f704684fe36b96042c0bb8084fd0dabd6d7441c5522b88c4dba87dab1d2a13a1f867ccb12400c2666de463592328f30528
-
SSDEEP
24576:e8l+EV68EsEXGfcUG4fwCXTI0IEMcwzSqmx6tQMZyHL9c1S84D9ToRodEHPIPcD:Z67X2kUG4f3TIcoQwULi1J4VoROQ0cD
Malware Config
Extracted
ermac
http://62.204.41.98:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.yusozofasuga.dadoduva1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
534B
MD599debdc4ce129b9bc5fe3e04b492320d
SHA115417e4cb512283287848ade2729ede8dcde9910
SHA25600c3d7a21fb85cc7ce778e7898ae08a1018a23b02f045ad9dd72b86fe9647bf0
SHA512f0283b5ad86ec687b3afec95da8f8408c649094e8e9f6e8d478f51960a1241eb2baf95cbf900a25b28894b3dd99cb5995b483c19202c72a6c9570c1adde36924
-
Filesize
451KB
MD5fb0ccc23b27e521f50842522a3f43060
SHA1cf013753d4e2025e6aa9dfa67213f463a033f32a
SHA2569950122a97a7c649b805d8fc521357ab6d2607adb1b2eb6f9a3fbe86b99bc9d4
SHA51271bd95ba79ef338c0b178ed210bc756ae685a60b0e463ffddc08ccba398c8f63f64aa18e4eb0e2c2897e116286ebf6c6bf71e4b69183daf5a690e2df356469d2
-
Filesize
451KB
MD5190ec91ee3e2d120ede03e493cf1c27a
SHA1b22c416ae2829d866d0a9b75d680c23c505a9bbe
SHA256d95ade0c00fde1f1d29bbfd9959761f942d2409fd68a5fa3b5386adc8d50e858
SHA512f73e619b74247379b234719a5ad2af68737321761531b123e86a488e4962dd01d5e8165409bdacd58f85fa59477d1d693714195a38688cc8a00e73955d601a94
-
Filesize
890KB
MD5ab16e04b52e006b2f1317a485000359f
SHA1dda556bcecd7e19fee1735fa10562d898452ecbd
SHA2567d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e
SHA512ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699