ermac | 739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb

Resubmissions

27-07-2022 07:51

220727-jp2shsfcb5 10

21-07-2022 12:06

220721-n9qm7sfgdq 8

Analysis

max time kernel
1050999s
max time network
184s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
27-07-2022 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36.apk
Size

2.2MB
MD5

366134f007de0bede5afb773774c4064
SHA1

62bec235f1067baf34a0d0b93dfb63e554e65071
SHA256

739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb
SHA512

11b8f919c2a2b92d3e8d48a4f586bf5c13123e976bb4980372f80d57bf43b65e8fdd04e69f4cd1c3a293da58c69cc7d4a0fcc4b4cdb5fa4f521f54a0011caa1a

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.118:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4602-0.dex	family_ermac2
behavioral1/memory/4546-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.majosiwuxexeku.poniva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.majosiwuxexeku.poniva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.majosiwuxexeku.poniva

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.majosiwuxexeku.poniva

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.majosiwuxexeku.poniva

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json	4602	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/x86/lTdXiAw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json	4546	com.majosiwuxexeku.poniva

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.majosiwuxexeku.poniva

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.majosiwuxexeku.poniva

com.majosiwuxexeku.poniva
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4546
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/x86/lTdXiAw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4602

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
456KB

MD5
c8dd7c66784ff7c7a55a0f018d5ba5e7

SHA1
f848b1a001bbc32709b6b229fdb460274d161167

SHA256
6243db51ab4a20ce9c8c5c59235347094c222e162944ce0b0958177c24f81f71

SHA512
33ba5c2c642deabbd306d80530499545148f2e2b14d8599fe4e986709990cb1a301bff6f0b11ab4ca33b59cf04036b3e8427dd85e6847d231a3b0e5188a8b90e

Download Submit
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
899KB

MD5
47a2d7399bc060adb4151493878fc7d5

SHA1
952665dd924b663bb236e8fed9807de42244c629

SHA256
18f927bdff087c24e380287d48048eacc015157e33f0909d3d6603e98e7f2214

SHA512
a327eae38ad394609b489e44150877051e23b2de3093f4b96c4f3538be6ccebdb028338ce142e32947015a4ad4662fde70769d8381a3eec841220ceff81e5d06

Download Submit
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
899KB

MD5
2bb06ce0b418fd54fa36013d131be94d

SHA1
a6ee5722c0d0c0dce1d3524d29aca334588c509a

SHA256
2e3a210d1821ff63420c1018a7598e321b021c4a9e85661b8d6714c4c379b75b

SHA512
6de4702b7a2e381de4a368e814fe6c3251d1b90d8ccc9753bd50991205cfbc7832eee158a2889f3d8f861edf0ebe9d6754af1851faafab69e1ab32e50e5e53ec

Download Submit