ermac | 71927786fc16e90fe05e1eb032c3591d878c7cfd197d02113d7d006e2d7b171f

Analysis

max time kernel
1563861s
max time network
150s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
02-08-2022 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

110.apk
Size

2.1MB
MD5

aaf8cd2c4ac88b48e79736bbe53c114a
SHA1

b3482f2c97fea3e03d8221eeb2f116c4a18588c1
SHA256

71927786fc16e90fe05e1eb032c3591d878c7cfd197d02113d7d006e2d7b171f
SHA512

ba62a4a1900cc0c2d618775ce9892c5df153dde032954e539f73133fbc2ed5303e112ca4b24d9cc804972b434fed1fedf4af55d70db600e19efa173fe16a47c3

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4402-0.dex	family_ermac2
behavioral1/memory/4062-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json	4402	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/oat/x86/lkkDad.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json	4062	com.ceveluriseze.xuca

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4062
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/oat/x86/lkkDad.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4402

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json

Filesize
455KB

MD5
b8dc757cfb33c5eb101156d556107b41

SHA1
74094c723987e18ebd2c9f47eab1c1783fbdcf1a

SHA256
94cc344253742f9fc6a9a4ddd14adae3347d6968504cc20809952592dceb04f7

SHA512
071432c7b364b9467d6389555bb5d3a7dbdc8ef0e7af5bb7144ffb40ad64b170a4d0bd00e97e853d5a7fbcfa1ce1ccd7a4fb5e2166c30a89d654c9373dc6b857

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json

Filesize
898KB

MD5
13b2df738e0110575ba98860d0d65250

SHA1
9525e6cd5cd48cc20c6a27f8b1e35093b087f215

SHA256
3056f89c702ce26462f504ae9eecd05c549d4865f5d52c0bcd2e46ef7b4df3a3

SHA512
407c3f4d9faeccfe3a5efaefb08cb1134e8ce5da3b322ebc3ba441b267ad34bb6b748d01492154e266e81f93f3d61940c0f7ae686f7e1737ee9657ad121ad3ed

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit