Analysis
-
max time kernel
150s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
27-02-2024 22:00
General
-
Target
33cdbe122b9770036722663c25cf778b6480973d8acf03c5a926f1b8b4d27e03.apk
-
Size
1.3MB
-
MD5
5086a26a597b08bcced09645ce779827
-
SHA1
48c041273dfad4e45fd39bc998190586c6fbb23b
-
SHA256
33cdbe122b9770036722663c25cf778b6480973d8acf03c5a926f1b8b4d27e03
-
SHA512
9213ef314d1b65f2751e4d78e63d8e3051654c55d10217453fc2123fc31f34f428bca6dd180ad49914a72a35fd27da7e301b735d32179a96867d0191589c02cf
-
SSDEEP
24576:aGTQvsnp/n891veoYJjrxBld7LMcnw6cmbDtz0uhuh1tzBozSkHdjDAg/OzfNNA:MCp/8912zJ/xBld7wcB3t/oDttDWAg/R
Score
10/10
Malware Config
Extracted
Family
ermac
C2
http://94.156.8.245:3434
AES_key
AES_key
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.wuxozeyoyokeva.fupuviro1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)