Resubmissions

03-02-2024 23:50

240203-3vjzfacff5 10

03-02-2024 22:00

240203-1wnynsbad4 10

Analysis

  • max time kernel
    5s
  • max time network
    140s
  • platform
    android_x64
  • resource
    android-x64-arm64-20231215-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
  • submitted
    03-02-2024 23:50

General

  • Target

    861035d786e4ba1ec206fcb22abf18e682b3c8481475e38fee54757fe8481c3b.apk

  • Size

    2.0MB

  • MD5

    7913e9cd5a581f61748f528242595843

  • SHA1

    6b46d917515c50d5d658bc7f73dd408a7c77eec7

  • SHA256

    861035d786e4ba1ec206fcb22abf18e682b3c8481475e38fee54757fe8481c3b

  • SHA512

    379617b6e340052a4148e27ea4ac606e105e44179b7d367e922463b853e8c86217de53c208295e3ea4c7f5eca4eee200094de9edab1d8cc5d1703bf4e16d7af2

  • SSDEEP

    49152:8dLFSkaUlfhR7hQsgeHqGQfRIycGDIvdrGe:8dLFVhTqGQfiRGDab

Malware Config

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

  • Ermac2 payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.lapagopomipavu.zuke
    1⤵
    • Loads dropped Dex/Jar
    PID:4516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.lapagopomipavu.zuke/app_apkprotector_dex/classes-v1.bin

    Filesize

    163KB

    MD5

    d70c16d7fe242aa1348c0c878954a628

    SHA1

    e724b1603994fe42e2152e71c7cfcd3b6dd7d4bb

    SHA256

    d9de8f70c30fdea92bb3790685e093f74b68dc232af9332b5bfb0b7d30577a77

    SHA512

    dfbfeaced2ce27478ca6ca9ac48d58492b888c774bd6905a827832f783793213149c775c970892d9fb68d30bab47e57f7df187a2b63178d83740d65c442543fd

  • /data/user/0/com.lapagopomipavu.zuke/app_apkprotector_dex/classes-v1.bin

    Filesize

    1.7MB

    MD5

    d75cf9b3238dd299ca9c2e41bb286b0e

    SHA1

    597f5b25648eff50dbb72962a592b4be98c60e16

    SHA256

    81ee1aaf066b158109b5208dfa554683c1a9681331b82c9e22f5023bb993552d

    SHA512

    65062731b58d675d890c9bf4265a1dec5959a8eba0691f373e330262b51d8593a2738a6abfcc54022dc65952aa49064c26e36065067b3daac50446f8812b4fee