Overview

overview

10

Static

static

6

e663336fe7...e9.apk

android-9-x86

10

e663336fe7...e9.apk

android-10-x64

10

e663336fe7...e9.apk

android-11-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240221-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
  • submitted
    25-02-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e663336fe730e52c815c88efe49f06db59713318b6d81290f519a7d7a1b172e9.apk

  • Size

    3.7MB

  • MD5

    c6e0e4ad1e47af7f0fcc8895356eba73

  • SHA1

    c39ea9e310922896844be874b07e7a2ff46b6efa

  • SHA256

    e663336fe730e52c815c88efe49f06db59713318b6d81290f519a7d7a1b172e9

  • SHA512

    cd70b13ce5d4efaad5227b5431e45aa282dcb9a38b4dd3e7ac31c7f1f031209c8181045a0e8d2e55a309ca0afea5d020b94f13ff4536722c4f78b792829956cc

  • SSDEEP

    98304:/lAeJKStt0eT0euXWBihqPCbAk6HlBJNng/H:9KSt+taPiAk6HlBJ6/H

Score
10/10
ermacbankercollectionevasioninfostealerstealthtrojan

Malware Config

Extracted

Family

ermac

C2

http://5.42.67.88:3434

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Removes its main activity from the application launcher 3 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.locokepigoxayela.kugi
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4293
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.locokepigoxayela.kugi/app_ded/efAFn2a7t5L49D6UhG7ZPpb9hamO4Beh.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.locokepigoxayela.kugi/app_ded/oat/x86/efAFn2a7t5L49D6UhG7ZPpb9hamO4Beh.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4451

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.locokepigoxayela.kugi/app_ded/efAFn2a7t5L49D6UhG7ZPpb9hamO4Beh.dex
    Filesize

    899KB

    MD5

    c1dce94d26b1b1446c64b385e68533e2

    SHA1

    b2bc774d6f3bceb1bd2931de45016b4a28cb73c6

    SHA256

    57423c32432532efb8c97f20e5fdbd4cd19d84af38a89f216d4695fb3b6370d0

    SHA512

    cad22a7339e6b267d3434a1a8bd7dabe3adc0fdba04cbed50644041a4d72bb9bb4c1ae5da8d45a7a5ea92bcc4b44ca97065f24ea8f2612750f9c1b8f12ea66d5

    Download Submit

  • /data/user/0/com.locokepigoxayela.kugi/app_ded/efAFn2a7t5L49D6UhG7ZPpb9hamO4Beh.dex
    Filesize

    899KB

    MD5

    30b704d601858344de30745e1c1520ee

    SHA1

    25ef0dba61e3cede27bf9d382f450e53245543ac

    SHA256

    27a68fd8de041614041abee54cd7a024dbb4fe6b49ba7d78fb0a2ccfeb579478

    SHA512

    ccfd53d4e197b6289b3a097012aa98cc1a868fe47aef601d63552795d1921cbc12ce235883a4634aaff8de02589370c6c7377bcb0e87c6c7851b76f1768cf528

    Download Submit