Analysis
-
max time kernel
147s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
16-10-2024 22:04
General
-
Target
b51376b6d2c0169da6ba817263177ed4004aed286fb6e83ef0414900fbc31618.apk
-
Size
971KB
-
MD5
ac1670faf415f738f34ff8e7e71fcd12
-
SHA1
7625a757405c725e44aaa7cb772a024a4cf1b033
-
SHA256
b51376b6d2c0169da6ba817263177ed4004aed286fb6e83ef0414900fbc31618
-
SHA512
fcc018d012d92def5d19363bf3f9c0fa4a1269c27e59e17cfaf98f181371b41f2e45153e6010ab40e6af1854aa0c19e11d5e42c478c3db4548f70cf00a1a9a21
-
SSDEEP
24576:NGy+rkO4LjXs/hJhKfS8zwMFbWNzSt8mg/vpB:NN9O4L72f0fSQ1amg/7
Malware Config
Extracted
ermac
http://103.38.83.59:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.pofupiwebafudani.xututo1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)