ermac | 495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617

Analysis

max time kernel
735123s
max time network
20s
platform
android_x64
resource
android-x64
submitted
28-09-2021 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617.apk
Size

3.7MB
MD5

a88a497b3ae6bb84209cac0906df61a7
SHA1

fd80903a98e187bc841a0aabe04528cc1654b8ee
SHA256

495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617
SHA512

684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a

Score

10^/10

ermac banker infostealer ransomware trojan

Malware Config

Signatures

Ermac
An android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac Payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi	family_ermac

Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.tafupqzpqgmn.tmnhkq

ioc pid process

/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi 3642 com.tafupqzpqgmn.tmnhkq
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.tafupqzpqgmn.tmnhkq

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tafupqzpqgmn.tmnhkq

ioc	pid	process
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi	3642	com.tafupqzpqgmn.tmnhkq

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tafupqzpqgmn.tmnhkq

com.tafupqzpqgmn.tmnhkq
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:3642

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi

MD5
c9fa87cda7b48167b61083339d8a8a5d

SHA1
5713569cada892f482f8f2357ceee3abf67238f3

SHA256
5f0679419f6c92fa94c310326fe2c88c3fea2725de9af43066bd487be8d35246

SHA512
96e9205c673f28a5e14395272aac2c676cc9cd1fd2454f6a13da69abf1a2f5af3035d4d1c0a24ab7a91762326f3ec96a2ec0aea43b5ca9e3f0ba7edf69c8e332

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/ogerpaau.eajd

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/tmp-base.apk.clbwfis6303907572551531606.ixi

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/multidex.version.xml

MD5
94dbb87f12bc5c1e76b43521e0456859

SHA1
22c04a830655f280ac80dfe3c7a2dce7bc7730a4

SHA256
5dd615efb1c6a8d766a8c03804404363ba2b4fa0a6576e109a0fb18485ace230

SHA512
e0b701954443698a5227e7d3cfdf184327a984febf9fc80af39c7f318b9a1daf777f18eea9d6d96a468c43011a01154e9258262a7a8173f86366a24d5a5a0391

Download Submit