Overview

overview

10

Static

static

6

e663336fe7...e9.apk

android-9-x86

10

e663336fe7...e9.apk

android-10-x64

10

e663336fe7...e9.apk

android-11-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    160s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    25-02-2024 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e663336fe730e52c815c88efe49f06db59713318b6d81290f519a7d7a1b172e9.apk

  • Size

    3.7MB

  • MD5

    c6e0e4ad1e47af7f0fcc8895356eba73

  • SHA1

    c39ea9e310922896844be874b07e7a2ff46b6efa

  • SHA256

    e663336fe730e52c815c88efe49f06db59713318b6d81290f519a7d7a1b172e9

  • SHA512

    cd70b13ce5d4efaad5227b5431e45aa282dcb9a38b4dd3e7ac31c7f1f031209c8181045a0e8d2e55a309ca0afea5d020b94f13ff4536722c4f78b792829956cc

  • SSDEEP

    98304:/lAeJKStt0eT0euXWBihqPCbAk6HlBJNng/H:9KSt+taPiAk6HlBJ6/H

Score
10/10
ermacbankercollectiondiscoveryevasioninfostealerstealthtrojan

Malware Config

Extracted

Family

ermac

C2

http://5.42.67.88:3434

AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 1 IoCs
  • Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
    bankerdiscovery
  • Removes its main activity from the application launcher 3 IoCs
    stealthtrojan
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.locokepigoxayela.kugi
    1⤵
    • Makes use of the framework's Accessibility service
    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5055

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.locokepigoxayela.kugi/app_ded/0z75bVxIytDkeP4dgkdVhfX0qiA2EohF.dex
    Filesize

    899KB

    MD5

    c1dce94d26b1b1446c64b385e68533e2

    SHA1

    b2bc774d6f3bceb1bd2931de45016b4a28cb73c6

    SHA256

    57423c32432532efb8c97f20e5fdbd4cd19d84af38a89f216d4695fb3b6370d0

    SHA512

    cad22a7339e6b267d3434a1a8bd7dabe3adc0fdba04cbed50644041a4d72bb9bb4c1ae5da8d45a7a5ea92bcc4b44ca97065f24ea8f2612750f9c1b8f12ea66d5

    Download Submit