Analysis
-
max time kernel
22s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
19-10-2024 22:09
General
-
Target
85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83.apk
-
Size
3.3MB
-
MD5
e1de2024bb46ef51a7403a198ee2a50c
-
SHA1
59dd12676fb2f6eb53f5976fadc9304aaec9b961
-
SHA256
85fa90ccb4e51f82fcbd2d20eb6aa05788def9235f7aba979f77a11fdb65df83
-
SHA512
64306c7d04f9cd4977bb95d7231d42362eeaf3704f3b238c91a0e372e316c0a330cbaeb6aba549fe55875295c1a6947661ca24cd2fd26afd69ad46b14e0d6701
-
SSDEEP
98304:2ttQSxjZ6K0utb3Ecblg05ao8OYBlePv5VY:2cSdkKxCv0f0
Malware Config
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac2 payload 2 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes
-
com.tencent.mm1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_mph_dex/apk.crazy-v1.AndroidManifest.xml --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_mph_dex/oat/x86/apk.crazy-v1.AndroidManifest.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD560d1af7146b2ae8201c506e2c9d9ce6e
SHA1b79d3963b3674b27ffb5c94d73ae91ecef446f2c
SHA256d1c5dbd927110864ec479b31d63df52a459812c7cce24c264de4bbaa93e6103f
SHA512ab8c78682462aac1c0d19913b25bb004517e1271373b1bed2b63b9ef6e58835657dfe5512ee9f5a3f3fe8549890581ab0faacb8a35c2ee1c556d9b708cd8ee4c
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD51b38c6d323e411c819dc3b2d0f3ba02f
SHA159f7de0fc5318af40587726aed9c538388bde957
SHA256c0bcd3cfbeef4694e24d847c826035c9713461c70d2bd3f84ce0b357623be312
SHA512b8a24397fa09894aa77d072f4394ba30d28b81daf844af017dccc0bf1e288e11e00fae5c1b2fc8b728c12dd47caac6e493b473310c37563abf725ae4015a3f89
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD55dd9933eec6e2d02816274bf93c4cc0b
SHA139a91e7b7b4c20c5fb6255916087d26213e026b9
SHA256ac7124a3f93890db04b9c72379239748ad59bd46e02109bd61dc47d1d8945b8c
SHA51262a50641853489ca1d98fe86030cf986d838cd9fb51c1e0e1710aabf33023e7c863c684b1039ddcb98f151f0ff4a2c8fad9faf24ef80df04ad8b161aa67cf370
-
Filesize
108KB
MD51f2010e28cd9f930a198654f0d5b51f7
SHA16aa615cdaeafc608b7c30409a469fb458ce71c8d
SHA256413a5cf43f86177d71f96914c3c65a3f6b639bd0b7ef00220ebe7c3faa19ed34
SHA512c2d1803c5ab08b01b305aebd677c4bb10e5e3d9e5a17513bd04abe74e010b106c2601c5c1bcf78b1b6b5c8cd3fed6822799b4fb60c348a9db8d2acde97657107
-
Filesize
6.5MB
MD55457b096949555f5fdcb0ab049f7c268
SHA12ad4b7b9b09894383552748fe9fbded05f534dec
SHA25657523298bc5907b9ba75a441ca36a8358fe3569e9889c850d36d38deaa2967f2
SHA51225fe11cb41cd3ac45ef44391026a885f3df38052a7259694b8d67b4341f94f2150af7990101a52a158e2ad31968d4be222e71585b439bae162480a1b04ad6ed0