ermac | cdf66b98f90a9e83b204bf2bb28915784f9e9ad4d2fb86648d1d1f7d3152dadd

Analysis

max time kernel
1657381s
max time network
179s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
03-08-2022 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

googlemap.apk
Size

2.3MB
MD5

19b095b01318ad679f5ff1d06ce143db
SHA1

e3dd97d403a9585ea0653f4134e4e5db4e5f6207
SHA256

cdf66b98f90a9e83b204bf2bb28915784f9e9ad4d2fb86648d1d1f7d3152dadd
SHA512

343126f50ab14194c63ec3be40b4d792bb9af0db43250f9f6baf92bc04356701352624693cd775f3c8051bc7282274defb1047790e4bec1492b53326c662cbb7

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral3/memory/5371-0.dex	family_ermac2
behavioral3/memory/5371-1.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json	5371	com.ceveluriseze.xuca
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json]	5371	com.ceveluriseze.xuca

Queries the unique device ID (IMEI, MEID, IMSI).

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5371

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json

Filesize
455KB

MD5
54bd155a1a151a3fdd189851daf81088

SHA1
2c8f8c16f153e45c035645a189f78110b529179e

SHA256
160a5d453352b03bf2be2f98e81d1330029fd119fb220a463301cfa93b28cf2b

SHA512
a50f10744fa7f3a519b1a7609030f96906a5f4e8416094238c77bdfbf2155e4d91c29277e5a8b03e82ab0b273222cca8c2d8f2dd77b5ab587ba56e8cc79102d2

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.ceveluriseze.xuca/app_DynamicOptDex/sU.json]

Filesize
898KB

MD5
0dd793db94e699d4e490877d6964117d

SHA1
28a9aab6508489595a79033d6ae7314fccfae320

SHA256
7219a96b565c66810afe1bd59353617e1a968abf30cdc3b43e431f45ca093b05

SHA512
3a4047b5d8cbbf1bfccb8f2a724ac2333437932fd486489a0c92163fe74209cf43b9485796e07a3ebb28964024c185245d5af2d26576d1dcf9b93316e09644d7

Download Submit