Analysis
-
max time kernel
2445568s -
max time network
167s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 08:27
General
-
Target
95528e4ac01389133c9940e67df9471f10a43a8c2da3bff32dd4537f7bf0b805.apk
-
Size
978KB
-
MD5
71f42bf00891cd9d6af8d52794a1aa54
-
SHA1
ed4dfc9bc7c0505b8341302a8f3fc3803815cd5c
-
SHA256
95528e4ac01389133c9940e67df9471f10a43a8c2da3bff32dd4537f7bf0b805
-
SHA512
ac2af77ff6919b553e20516b958dfc2e451a1be00554eae1b8c15e19ef678f08d7de624f13a38a24be6131463d940bdb6608c1e9d8753a4176033b69dd50b257
-
SSDEEP
24576:6TO1XXkclB8C5P4sAgvHrnNpaZZvKcgSCUiM:6aBkclB8C5zACL2gS5
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://194.26.29.28:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 2 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.yajaluhovate.lewexibe1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)