Analysis
-
max time kernel
2481818s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 10:36
General
-
Target
a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1.apk
-
Size
2.7MB
-
MD5
035a2266813f3d204c64b7be514f913f
-
SHA1
09ce3654ff984682c917d1b37c28d245f771a6c0
-
SHA256
a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1
-
SHA512
73a6016d7ddec0102f4621f05940dd3103264295fb45c5073ba9dfc2576e903f7dc3828fa21defc8174ea14e0397242afa4fd1812e137c1d19eb5f9a69ab5112
-
SSDEEP
49152:xWrpqJ2SIjTsnRQ96BVMZlf4fcrkDTCv5ZsOzrdtGiZjKNlNs:epqgS0q+g22C7zrLGSMlNs
Malware Config
Extracted
ermac
http://193.106.191.121:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 2 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.loloxitohuna.pitogoxa1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652B
MD587080241664f7aaf476075a03281152e
SHA1bfcb6d00f69f7f0eb00c523cecc485e7f2332a7f
SHA256010397b112fcf369ed975845c19309f0af4253a34975c9e229532f2abbb07616
SHA51247c7ec1fd7e28ab7d72a3a9e3f055e4a650ac3b2f7b0e51ba0e069caede3ec49a3000adce8253e0d53c6ad0df40187e744b34b445ffd461bccd3130edfb61ff5
-
Filesize
667B
MD5a67718fb828a0a0421f305b3832c39ee
SHA12b6a0d1805a3bf1af200ab77c48154895962f560
SHA256ff33dda5f16cbdf1c5dd1b26be2b8cd2d245e0402a44b5bc0681b18ae9d8092b
SHA51227b540669c5871646231e9c96729cac700b7c57a9b15adf27555e675b368621147eb05afc15dd14463e6ebd09a87a5a535c23016bbd7463c7cfcb37e436260d0
-
Filesize
456KB
MD54c861f23b48c50285d3fe240a336950e
SHA1527cf74f4f20ff2afd67b8a0ac04fa83b7bcb9c2
SHA2566604888c866c79aeebc4a038dc7d5ebf652037d4de71659f96f84f2193dde5fa
SHA512428f65798ce60ebcdc3bab385471cf7c0b2531ec52dfe21cf446808902580e4b477c4f75a404dbf8aa2bc5443683a5b8c0550322262c6c23fd0f89c64bc954fe
-
Filesize
456KB
MD5dbca80627a721964e636e3cbb30f9b2d
SHA1741a237cd5f831d29a547606b65f9303fac722cb
SHA256167b174e02b58ac4d2d7513dd0e5f6a29f0d733699aeb1ca3f1a67e17556f92e
SHA5125865f7ac40cf08ff07072322d64398af9c3d43d54d95b96ad28e52732dbe07e535c3b3a2856ae9829160ca2cc287f0ef3136a0b7e7eeb99eaee8534a2418589d
-
Filesize
899KB
MD52149d0e1c412d8a5e22b955a46ada4d0
SHA1e9bf7faa4653613f261e1539373959b83c4346d1
SHA2564c9091f9d6538bba4c53ce557b5ef35f47c86faad03fbb9b001232c70960a1ee
SHA5123c8922374b44932ad16093b25688e650a2f255d2a351ce8db1e6ac9991df122b66ae414c5887322424cc6ddc8f5c676e775515313096611c9f60382a8f88809e