ermac | cdf66b98f90a9e83b204bf2bb28915784f9e9ad4d2fb86648d1d1f7d3152dadd

Analysis

max time kernel
1657310s
max time network
57s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
03-08-2022 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

googlemap.apk
Size

2.3MB
MD5

19b095b01318ad679f5ff1d06ce143db
SHA1

e3dd97d403a9585ea0653f4134e4e5db4e5f6207
SHA256

cdf66b98f90a9e83b204bf2bb28915784f9e9ad4d2fb86648d1d1f7d3152dadd
SHA512

343126f50ab14194c63ec3be40b4d792bb9af0db43250f9f6baf92bc04356701352624693cd775f3c8051bc7282274defb1047790e4bec1492b53326c662cbb7

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4199-0.dex	family_ermac2
behavioral1/memory/4134-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json	4199	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/oat/x86/sU.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json	4134	com.ceveluriseze.xuca

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4134
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/oat/x86/sU.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4199

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json

Filesize
455KB

MD5
54bd155a1a151a3fdd189851daf81088

SHA1
2c8f8c16f153e45c035645a189f78110b529179e

SHA256
160a5d453352b03bf2be2f98e81d1330029fd119fb220a463301cfa93b28cf2b

SHA512
a50f10744fa7f3a519b1a7609030f96906a5f4e8416094238c77bdfbf2155e4d91c29277e5a8b03e82ab0b273222cca8c2d8f2dd77b5ab587ba56e8cc79102d2

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json

Filesize
898KB

MD5
13b2df738e0110575ba98860d0d65250

SHA1
9525e6cd5cd48cc20c6a27f8b1e35093b087f215

SHA256
3056f89c702ce26462f504ae9eecd05c549d4865f5d52c0bcd2e46ef7b4df3a3

SHA512
407c3f4d9faeccfe3a5efaefb08cb1134e8ce5da3b322ebc3ba441b267ad34bb6b748d01492154e266e81f93f3d61940c0f7ae686f7e1737ee9657ad121ad3ed

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit