ermac | 71927786fc16e90fe05e1eb032c3591d878c7cfd197d02113d7d006e2d7b171f

Analysis

max time kernel
1656966s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
03-08-2022 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

110.apk
Size

2.1MB
MD5

aaf8cd2c4ac88b48e79736bbe53c114a
SHA1

b3482f2c97fea3e03d8221eeb2f116c4a18588c1
SHA256

71927786fc16e90fe05e1eb032c3591d878c7cfd197d02113d7d006e2d7b171f
SHA512

ba62a4a1900cc0c2d618775ce9892c5df153dde032954e539f73133fbc2ed5303e112ca4b24d9cc804972b434fed1fedf4af55d70db600e19efa173fe16a47c3

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral3/memory/4850-0.dex	family_ermac2
behavioral3/memory/4850-1.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json	4850	com.ceveluriseze.xuca
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json]	4850	com.ceveluriseze.xuca

Queries the unique device ID (IMEI, MEID, IMSI).

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4850

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json

Filesize
455KB

MD5
b8dc757cfb33c5eb101156d556107b41

SHA1
74094c723987e18ebd2c9f47eab1c1783fbdcf1a

SHA256
94cc344253742f9fc6a9a4ddd14adae3347d6968504cc20809952592dceb04f7

SHA512
071432c7b364b9467d6389555bb5d3a7dbdc8ef0e7af5bb7144ffb40ad64b170a4d0bd00e97e853d5a7fbcfa1ce1ccd7a4fb5e2166c30a89d654c9373dc6b857

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/lkkDad.json]

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit