ermac | 7a57d72506882fc711d3f739c422ca865c9a2fb5246b9d0c459f017909711e40

Analysis

max time kernel
1564151s
max time network
122s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
02-08-2022 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

987_obf.apk
Size

2.3MB
MD5

7b07d5510817ba128f6486293e579492
SHA1

85e915ccf11001191af3b446350b0a24e5f36f31
SHA256

7a57d72506882fc711d3f739c422ca865c9a2fb5246b9d0c459f017909711e40
SHA512

06051628a03255bb4fed834204526335f9201ba8175944e0fbffe3a0432353f653c7feb0290bb225db07ac7a011dd90d563783897d5bb8ded8da60d38e67912a

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4651-0.dex	family_ermac2
behavioral1/memory/4370-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json	4651	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/oat/x86/sMj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json	4370	com.ceveluriseze.xuca

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4370
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/oat/x86/sMj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4651

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json

Filesize
455KB

MD5
32abc180942ba895d872f317ad6278ab

SHA1
7a375511c977e6c6c42d4010ed92bbec6b0d5faa

SHA256
a9e461c579ca43350930342334684c23265620abd6d6750aa86226a7e29b8024

SHA512
72173050a5b267f43d5c6cd714decfbfc56418881955fe7ff9cf33709c7d931c19d068993718255141c38a371dd3f7d060b5879ba8445b50202111ae367e3b3e

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json

Filesize
898KB

MD5
13b2df738e0110575ba98860d0d65250

SHA1
9525e6cd5cd48cc20c6a27f8b1e35093b087f215

SHA256
3056f89c702ce26462f504ae9eecd05c549d4865f5d52c0bcd2e46ef7b4df3a3

SHA512
407c3f4d9faeccfe3a5efaefb08cb1134e8ce5da3b322ebc3ba441b267ad34bb6b748d01492154e266e81f93f3d61940c0f7ae686f7e1737ee9657ad121ad3ed

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sMj.json

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit