Analysis
-
max time kernel
2466705s -
max time network
158s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 09:49
General
-
Target
9eceb9cfa14c5f82cf31bdced380faec9bf35060defe355c066e1acb36ba66ea.apk
-
Size
2.0MB
-
MD5
26bbb10b28f49e3f0802e515b80b433c
-
SHA1
e92586db0d1e1699baba2de748562d11b2177380
-
SHA256
9eceb9cfa14c5f82cf31bdced380faec9bf35060defe355c066e1acb36ba66ea
-
SHA512
1febd124383efddad324b0cc6f0ce73fd231f0e8bcc85e076622533a66d30b3a86505acb079cce77d258f155ccc8522c645da49f5bd90cf2cc15d20560166ac0
-
SSDEEP
49152:ybKBBbUq0PhXIYr8NdT64fm+OPQOO/AP8bW43:lBBb7gXI28bT2+f33
Malware Config
Extracted
ermac
http://193.106.191.118:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.mazocexayori.kute1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5b2693b13d14bc3fb7a2f439ac13a9e1a
SHA1a2660240ad46e39bc74dc3c6e77c284e40fec464
SHA2563d34855c12421965f240c93e5d69d7dc7a445e5a723f738513bd9c971a1e44a5
SHA5120c62f9d640f301a12ed44f55be04a0ef3342022a87a8968444d1c4b04bdf8c66cbf45fc94e51eaf9e4ebe307140333ffd1ccccee8cffc879ee792617f3aad670
-
Filesize
455KB
MD536c2592e0d6ccc42d1bfb9ead0dd381c
SHA1de6dfb28063fee3dfb8b6557e826196b1ceb703e
SHA256efb1d45fa091001b7ec273a6660c62e17a1d9e89d3fc34798894c8e9b73ddf7f
SHA512c85ae4455a455532933ce55aa6a5c9c0e9c6d567a3b2d9fa858105df3a3802d55ee39297126d9f02501aea2bd187efc49505b26ada672dff2eca064751a66dcd
-
Filesize
523B
MD502a1b9a7df7ee2d4e014938ea282f1c9
SHA1b3b8e8feec2813eb67b267ac1fd63f5eb52e9fff
SHA25633383655f0cd34cb5183d7ef65892a6642d2360862d89c43f2cd608e7f9fcd11
SHA512457a555e3316f716e9b79baef7212251e4fb90220b6c33e0fe3adaff21bed9b1430d06441118d46efebbfadfac341fe6e4760e6b1330a9f479e0010e21b69a6b
-
Filesize
899KB
MD5469e764d83595045fb5f0d08b03adb3a
SHA19b31424e2be9320e4484235691c2e39aaf870271
SHA256d4e5fc87c9c19bcaa58bd78327d7eb240c983435cd6eaa772424c4166248177c
SHA5127caca18d874d3731cc7a5ebfc9f1ddfe87793557e00b5592e909f333f6e1a1dbb12040132d51ba02567360720d54e716102c212f711b9a80ceec8c3f1194e56f