Analysis
-
max time kernel
147s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
14-01-2025 22:08
General
-
Target
904422715a4132eddc6f5ca370ee05831f5c821c58abb53d25e0b7de3a9dd4ac.apk
-
Size
2.6MB
-
MD5
be161c7c4b23890809618d9830a543ec
-
SHA1
b0993da4e434ecd60082603107dfdf50b196aa5f
-
SHA256
904422715a4132eddc6f5ca370ee05831f5c821c58abb53d25e0b7de3a9dd4ac
-
SHA512
e6cedbdbff09aca5accdb53759ada0d33e3fde449c3f0812f6ea8ba77444a95cd7e363ee91d1b59886cb2e8c56a9585632b4bb1da40590dae6a51ba91b4fda9c
-
SSDEEP
49152:p/eSCbqzGXqaziXNaJj+fe3j4LQ4fW1WONz/1b/+oEjYVP+f:FeXbRRiXN+3j4LYTbG2s
Malware Config
Extracted
ermac
http://45.141.85.25:3434
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 11 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.zixudahitifo.gicu1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
445KB
MD5c0f1b37b9dda7e057f5d42c8e2604420
SHA14627843ae783c43434207f90863bdbec253a1645
SHA25618000a3206695ff43dccedd072485b8f05221d6fe34e75d244ad3b9bfc3d32b0
SHA512b549f201c911d7a422663334c4a20bb28e619468e4520609a353b46df539e371d0fac8f08d4cfb586cc778ad528390ccd2f4f6d9bee921c44b71a0a3cc050f80
-
Filesize
445KB
MD587af5b5f9f9d6f51025e51d8c2a9b16a
SHA1f31297a09ca231d25442908b198c076c0df9ff8c
SHA2569dae4db917d2897d3f5cea43b8280ca0373118332b07782b487d829262d64539
SHA5127e5004b2e25b48e553f77f3e72fd863c71617dcb17a1a9ea1c8cfd7c4176945f1919c618d0b077a6b470a273a8ea08813d163907d832bfc07e5316b3996ee33b
-
Filesize
531B
MD5370011d0be775b38f111c30117dcbfa3
SHA1bb8e866275c85c38586c4fe46facb4485fb4d07f
SHA25636e594f7e6f41b14c2e97d43fccd685f55ba206e7371b68e32aeda82bee03ae6
SHA512c4ef772b14f01be19ebba55dec8ceb9f7989555a952a0517a4734273eec454be2a2f0c95f11cf8faf2c713d5d06f04360d66542b39d23a7787d0dd760c23d972
-
Filesize
877KB
MD5c6470c5c0c03d4966568128160294363
SHA1884af0b8dd15928ff2e9de39ff90fc02bf72ae5e
SHA256438d81717253770e51cd32c40f60df6566e9941f36293c6bfb9904ffbefe7827
SHA512a8d5d53398da1e9fe0229c6f3d7b483f6747168900f9b58090be4e760b14ca4dbb416a4fe650cbcce38e20142a8e6260d13fda88e11db7852e1966f7d66069e9