Analysis
-
max time kernel
2481851s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
20-12-2023 10:36
General
-
Target
a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1.apk
-
Size
2.7MB
-
MD5
035a2266813f3d204c64b7be514f913f
-
SHA1
09ce3654ff984682c917d1b37c28d245f771a6c0
-
SHA256
a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1
-
SHA512
73a6016d7ddec0102f4621f05940dd3103264295fb45c5073ba9dfc2576e903f7dc3828fa21defc8174ea14e0397242afa4fd1812e137c1d19eb5f9a69ab5112
-
SSDEEP
49152:xWrpqJ2SIjTsnRQ96BVMZlf4fcrkDTCv5ZsOzrdtGiZjKNlNs:epqgS0q+g22C7zrLGSMlNs
Malware Config
Extracted
ermac
http://193.106.191.121:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 1 IoCs
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 2 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.loloxitohuna.pitogoxa1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
501B
MD5d0200674b18042f787e1dc7f587b04a7
SHA1d496ddd795efb71ffe1ed292203e7bedbbbebc3b
SHA256b7e8fc2fef6af35ab87cbae596ea9c12310a5eaa97cb149b40c98cdb6bede578
SHA5124954cb87b21401fa9948ba729a176a4c3bffe5dc0cc6316966e57936d4d3918e5ac6e79fc3a08997fbe1cb38c61cff36ceca5117e019c9cafdec8cb9f74c1a81
-
Filesize
456KB
MD54c861f23b48c50285d3fe240a336950e
SHA1527cf74f4f20ff2afd67b8a0ac04fa83b7bcb9c2
SHA2566604888c866c79aeebc4a038dc7d5ebf652037d4de71659f96f84f2193dde5fa
SHA512428f65798ce60ebcdc3bab385471cf7c0b2531ec52dfe21cf446808902580e4b477c4f75a404dbf8aa2bc5443683a5b8c0550322262c6c23fd0f89c64bc954fe
-
Filesize
456KB
MD5dbca80627a721964e636e3cbb30f9b2d
SHA1741a237cd5f831d29a547606b65f9303fac722cb
SHA256167b174e02b58ac4d2d7513dd0e5f6a29f0d733699aeb1ca3f1a67e17556f92e
SHA5125865f7ac40cf08ff07072322d64398af9c3d43d54d95b96ad28e52732dbe07e535c3b3a2856ae9829160ca2cc287f0ef3136a0b7e7eeb99eaee8534a2418589d
-
Filesize
899KB
MD52149d0e1c412d8a5e22b955a46ada4d0
SHA1e9bf7faa4653613f261e1539373959b83c4346d1
SHA2564c9091f9d6538bba4c53ce557b5ef35f47c86faad03fbb9b001232c70960a1ee
SHA5123c8922374b44932ad16093b25688e650a2f255d2a351ce8db1e6ac9991df122b66ae414c5887322424cc6ddc8f5c676e775515313096611c9f60382a8f88809e