Analysis
-
max time kernel
427133s -
max time network
158s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
17-01-2024 22:01
General
-
Target
671c4a8a4cb0d566471e3bc405db08daf9e47d1593014c8fb59fe3b136bcaace.apk
-
Size
1006KB
-
MD5
6353c4af6b6ddf9940884d2c38f38acd
-
SHA1
1f1e736c59654d3f98aa24d5b1250f1abae12f57
-
SHA256
671c4a8a4cb0d566471e3bc405db08daf9e47d1593014c8fb59fe3b136bcaace
-
SHA512
6d4b5c4e36b17fc5201292404b3d012be495d2040a60af4987f21b90c34a77f58553f12f3945077c371778b0feb7d85c51eae271866742921373721e3cfcd4e7
-
SSDEEP
24576:vmmpWhJwuI9QgMprkJ0qEbRCxCnCiCmCVCUCZCGCxCzHaWgx:vmpJbAQX3RcqTLQFErsAHaX
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://38.207.178.212:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
nusku.ermacv2.apk1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)