ermac | ca56e3f365cf8400b677c650250c37c967ead4d06f79620bcec7f73818bdfb46

Analysis

max time kernel
1564470s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
02-08-2022 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

photoapk.apk
Size

2.3MB
MD5

80714569a9addf2781596516ba954c57
SHA1

4bdf1933942683b63e4bdffd4c0e7c41ddf7ccc1
SHA256

ca56e3f365cf8400b677c650250c37c967ead4d06f79620bcec7f73818bdfb46
SHA512

06bdf0c5251563b499ba6aaf2896dc060531220459c6a3733182fa41029931bdc2df4bbd8e6f97ea15312df44a4a0d4adfac1929dc374047bed3f5076a9b9aa8

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.118:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4826-0.dex	family_ermac2
behavioral1/memory/4762-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.majosiwuxexeku.poniva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.majosiwuxexeku.poniva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.majosiwuxexeku.poniva

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.majosiwuxexeku.poniva

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.majosiwuxexeku.poniva

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json	4826	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/x86/wPblKNY.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json	4762	com.majosiwuxexeku.poniva

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.majosiwuxexeku.poniva

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.majosiwuxexeku.poniva

com.majosiwuxexeku.poniva
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4762
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/x86/wPblKNY.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4826

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json

Filesize
456KB

MD5
7d05175076aa943713eb53d1b36ad2f8

SHA1
c8b26d48eb0af8d326ae4cce21d8088c30fac51f

SHA256
b91dc7bfd7d4d028eae574532e03f5cfb46c24547e61ea3bc34f635d9ef50fca

SHA512
136ab98c3855c9a2d38833d0446de9e66f5d9c805b9e974b98838e240e86ca36d3d9e8f7e3fb7e975d2439555a94fc32a6b9e57ffa4c9a7d8036b8b4f68db113

Download Submit
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json

Filesize
899KB

MD5
47a2d7399bc060adb4151493878fc7d5

SHA1
952665dd924b663bb236e8fed9807de42244c629

SHA256
18f927bdff087c24e380287d48048eacc015157e33f0909d3d6603e98e7f2214

SHA512
a327eae38ad394609b489e44150877051e23b2de3093f4b96c4f3538be6ccebdb028338ce142e32947015a4ad4662fde70769d8381a3eec841220ceff81e5d06

Download Submit
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/wPblKNY.json

Filesize
899KB

MD5
2bb06ce0b418fd54fa36013d131be94d

SHA1
a6ee5722c0d0c0dce1d3524d29aca334588c509a

SHA256
2e3a210d1821ff63420c1018a7598e321b021c4a9e85661b8d6714c4c379b75b

SHA512
6de4702b7a2e381de4a368e814fe6c3251d1b90d8ccc9753bd50991205cfbc7832eee158a2889f3d8f861edf0ebe9d6754af1851faafab69e1ab32e50e5e53ec

Download Submit