Analysis
-
max time kernel
12s -
max time network
163s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
19/03/2025, 22:00
General
-
Target
43573ce77b2793e9a8625998090644d255b00f29efeb72cae072cdeaf1a7a43e.apk
-
Size
1.5MB
-
MD5
6d05cc90ed36940c534f070871cffdf1
-
SHA1
09b5b6af4c9c3ad3a8580201c1f6786af625923c
-
SHA256
43573ce77b2793e9a8625998090644d255b00f29efeb72cae072cdeaf1a7a43e
-
SHA512
a03fb15c79c90f1ced564d0f47f8200c2f954d589c2f2c242795a8152056ee9bae278f2b21f712b66d73d01e4101788a2b32ea6c66fa3649d1f3969d5ac6fd03
-
SSDEEP
24576:4P7PpHfrmbtj5rDVE5h8aqVlnC/9p9SrRJgSrN9W3WlQfg+:4P7qhKCaqVlnMDMgSmW2g+
Malware Config
Extracted
ermac
http://176.113.115.150
Signatures
-
Ermac
An Android banking trojan first seen in July 2021.
-
Ermac family
-
Ermac2 payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 24 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lexujemiyunu.wana1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD56526a0ee2e3c8ecdd3dcc40675129d7a
SHA186158ccc05b19f6e3a3a97ae7e0d9fb3d2b4f6f9
SHA2565a6aece9d70498587f333cc446161bf8d06e940edab9c25865adc126d1a2b9a4
SHA512928c2c07b656bb9bc2be210f421b556bc8eba8420c85180e5f1fe59eeb61561d65cfd83d7c4eaafff319da08103cb788f716c264950e01122b03466f2fc0a3af
-
Filesize
524B
MD5632cb4382cb42c09d273f68ab284b78b
SHA189dc99a4a6f61d324c039298eb5a65e249238481
SHA256d106388bb1c03d7c94a91b2226c278f4f51d24da694218d0e80b053e6743e1b0
SHA5126d13c2ae2dac46686e90bfa517dbdd3dd6ffa216bc296136f0f03590e91077a3ed8b42f9541c8fc1a3020b2d469c01915289ba6de75fb22bc200f805cec96019
-
Filesize
1KB
MD5ff5581496b861ef76943bb4ee023d7ac
SHA1ccf39590144c9098264ed596a0fc3d1eaa089730
SHA2560e1e46c8b2786c239b80478324a26f898e4e6c6361fa5bad2a42f9c2711f44c3
SHA512d6d7316def2b57c2a36ff26dc80769c724e59b623100e424d69094aef85a77e1209ee375337289f9cb4cb47a4d875ec260cacebde6878368f68b6ca90f4e99b4
-
Filesize
1KB
MD5054f9ca6936db0328e6cf1595b667555
SHA1db67905874741dd578b6c4aed001d53e1fdeaefc
SHA25660a6051f4ed416c1ba0a1b1a3e02273a4da414bfb2fe8c89918439dd30e92ef3
SHA512741bb21df875ea913b65985dbd9f70d809df9ae5a604946cbf3e4236c127201471b4e60eac009dd3cb163562fde6179ec0f4d2072d68d0fba7d3af74e0a0ad2d
-
Filesize
788B
MD5a8200aea9ee28381b4a72d44980a55e6
SHA103dcbd53a75f6be48607b3eea5b925a224777210
SHA25621c15c3c1671306513b3c0d17975efdfa01e26e50b7a01aca040241b3c9638db
SHA51264d3e4c3b539c0e5d69dda7cc3f30581b3c0ff3705b0b39850efde2b3457e443ece193d6f3c9f08fc9582669669c5e634876bbcc75dfdb4be75ab9c3f762af00
-
Filesize
885KB
MD59800aeac47d79ee3d9965c4662aa99c5
SHA161bfb8b3a8c809e8cfdd8906848f19292f1d0eae
SHA2562681beebe5a760a197c0d5685545b67ec9695b32cd3e04f573c7138010ed8fe3
SHA51281fc6d3fcaf0012d10204b56f36fa36bb159f255199ae5bf8fe50c42aa8895608c2f48b9f91adde747a621cc29264b495c9d02979f3dc23396fe5b00771c193b
-
Filesize
192KB
MD5f7fcf58e720d149ad50ae6a50c5d1506
SHA19e51db81045b50e4bec07d614e7429cd13c4f16d
SHA2560b9ad587006069acb63a3c07b96781b699a1ac163e0ba52190deeb9adc2a4989
SHA512ad13848493288734d245b9ca6d970cc1de4fe693ccacbc176c33bbdf7e794cfb257f811ab18608e367e34d7cc771227f3dbe78cb400bfa83f7fdf0f5ad805ad9
-
Filesize
30KB
MD573b5595e570f7a22f92de49e466d3c40
SHA1b24ad99990ef61c2eee73b9ceb60edbba65cd621
SHA2563fe3ce420c34ea08f30f9a844d9bed71a45899f24d960a8d6bdf57f0ca13c39e
SHA512f8b2c6764ba0f777a28d3a0d5402d1bea4f3926bd8f88a61326848c201e74a5c7af84072029f915c2e474cc98ebc7b2567c4c3477fe98e27c74cfa141e161b1f
-
Filesize
1KB
MD5eb9451207e09da29d58398d9b1043a9a
SHA16562d95ec7b406c4290cc7402a70c663ae688533
SHA25653e81258b5c9fd017ebc7d949ea889268925dd947b99f91b483c47654764059c
SHA5124681e9cbbebebaf7b385267ed047af1d708c10ceafa26a3079be038cc99db1295dceae22d9d8fb3852c3393b0cd8225713a0d4d7582453bce904b9834e86eaf9
-
Filesize
1KB
MD51666a962dbea655cd72305b9ffcb4b7c
SHA1c13bf6f87c0dc5e3005a12032c0e3c63b6331bbd
SHA2566ddd1ec919a923af13cd1caea2045d364757aa7c235674ce857e4f2199a8cbb7
SHA512ab9b2dac9b0f9a2a6f443239775b631bfeaa88119fc64fae5bc1e5640955c6a3d2a3aba491dce9a280581690d13476639d5c644d9651337d79c432ceb5ae8b3a
-
Filesize
3KB
MD57f330b197a6e5b2a6e57c64d4a985d46
SHA12d4dff57eb7bc0fbc6fbf72bfa51e41ba6ad656b
SHA256d8058cec727f3522940ecc0bdc43d96a3aaef0edc082eda8cf8d3b810fb1219c
SHA512eae341498a3fb78852bf2691f3d21136a1daf6a451e5167b321106573e7a0b1a17d027efc13552d28e1dca571abc071bf1f23c51faad3dc1775e3d1637a328a8
-
Filesize
840B
MD50d39ee5a6ce169cdcb66eeddabc6c4b9
SHA10ae744c79867f98a34a60c24687a64827376df94
SHA256960ac04236664132be07bda00e87c5d4f5ae8c43845704896889ef09378a8478
SHA51272473770c30f6a7b5a664d84f450e1a7b0b4c37f6dd705e43743bc1371500936d4119124976d5f39013f280fc5defc767cf3e3680fdd8d332978ed0935d8aeb1