Analysis
-
max time kernel
150s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
24-01-2024 22:03
General
-
Target
8d7625059315f37b0fde19b657d8aded842f052699c208d6b0031720460918dd.apk
-
Size
1.3MB
-
MD5
97c7b633a249b19bee41812c3d7eee6d
-
SHA1
49920634eeb3aaf79e5cb4e75b252f6ff4d91ccf
-
SHA256
8d7625059315f37b0fde19b657d8aded842f052699c208d6b0031720460918dd
-
SHA512
96d23ac66b4fb7ac402328eb5e293114c388a34e047cdb5b39e356f3cc19d29ed28e541be9c3d3e4c86c20828c40b3c258e778d7c8d0faa0b32e5446d8126fd1
-
SSDEEP
12288:y3jdQjsHgc1d5L/flulcmPIgApVDXUEe2B:y3jdjN/fIlcZgS1UEBB
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://185.172.128.91:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
tdevs.cod.apk1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)