Analysis
-
max time kernel
152s -
max time network
160s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
22-02-2024 22:01
General
-
Target
73574e74b7ed1a28073c056e2836ba06a9b98d7a327d9240ffc4b42832d21fc0.apk
-
Size
1.3MB
-
MD5
1cc70ee6537c378ceedb4852a223eeae
-
SHA1
8f651b729ebad19ef6f2befebf5fe2800344682a
-
SHA256
73574e74b7ed1a28073c056e2836ba06a9b98d7a327d9240ffc4b42832d21fc0
-
SHA512
6a4d7d1014275fb0d90e69a58ca27c830faa885a695a5523418d245c5427f5fbf33629c9c60581f83497caad812f931c3e81b0b07588018e73b607375dda7de9
-
SSDEEP
24576:2+AHBgwK+SfMPLhZU4fyHu+c5+SiW+IB96XW9Oyir:b2ZuMzhK4feHSir
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://77.105.132.32:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
nusku.OxoChatservice.apk1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)