Overview

overview

10

Static

static

6

a4fdcaa0ae...1e.apk

android-9-x86

10

a4fdcaa0ae...1e.apk

android-11-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    13-10-2024 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e.apk

  • Size

    1.8MB

  • MD5

    22597c6ac1c89b9b31a1c135b613a645

  • SHA1

    2192ad0149233dd8477babcf64bc643a5fca089a

  • SHA256

    a4fdcaa0ae189a20b04b0adfc99a5c3810fb01201517569f078ec59449befa1e

  • SHA512

    10a5bd408d886d702773aa735a2e17dfb3e398b90f47e9c84224b46b04848c5271d1be49d5b042bdf9a064a1e0187a2efad105ec5ceb48a78fabbc36a4770074

  • SSDEEP

    49152:Zg/94Z2SrHmjLKxqobYnc1Th+tompsZKnnmTD28o2a3+glD6s:hHmyxH1Ty+ZKnncDoblD6s

Score
10/10
ermacbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

ermac

C2

http://154.216.18.158:3434

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac2 payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.makedubefomi.tudaki
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4214
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.makedubefomi.tudaki/app_apkprotect_dex/apkprotect-v1.bin --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.makedubefomi.tudaki/app_apkprotect_dex/oat/x86/apkprotect-v1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4279
    • rm -r /data/user/0/com.makedubefomi.tudaki/app_apkprotect_dex
      2⤵
        PID:4303
      • rm -r /data/user/0/com.makedubefomi.tudaki/app_apkprotect_odex
        2⤵
          PID:4317

      Network

      MITRE ATT&CK Mobile v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.makedubefomi.tudaki/app_apkprotect_dex/apkprotect-v1.bin
        Filesize

        1.0MB

        MD5

        020c2fe46313eba9352761a685aff345

        SHA1

        cc37a8d7021234d734fe35510cc4a939b72e3e88

        SHA256

        4c7df706fcf6a588090fe1478f0af193d9df12f8a2b26cedde656127bd33e5a6

        SHA512

        8498593deb09709b431ea06a3d52d3a2d1aa9c9173f0155d74dd536d64b7900411a026090b7d8d43baef07f26074c684277af9fcb4a62fc55bac73fcaa88a6f9

        Download Submit

      • /data/user/0/com.makedubefomi.tudaki/app_apkprotect_dex/apkprotect-v1.bin
        Filesize

        1.0MB

        MD5

        2a48fc0d360331ba99d112388b413f91

        SHA1

        ece0f9b0498eb2e069bfb9d6f65d7d5f3d01c488

        SHA256

        ce16b903b53d374ff258f817ee50d077f9581516407ebf9bdea3753448b3c73e

        SHA512

        73d74491295d640b83be5df7458d1be7ef698778ebfe8e43164b2dd0508125b3745e91ae2723310295656788700a5398a58672169a514bb0a5b1fc764e66b774

        Download Submit