ermac | e0d2b13e45213bbb392b8ac873879afb87ec89155b8234c61facbe060acb2fd0

Analysis

max time kernel
3209111s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
21-08-2022 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fc0ef665382cc3a2c23100625a1fedf.apk
Size

3.6MB
MD5

3fc0ef665382cc3a2c23100625a1fedf
SHA1

b39fc47f0eb2d862a2b79ea3a88e0a8f46e6858d
SHA256

e0d2b13e45213bbb392b8ac873879afb87ec89155b8234c61facbe060acb2fd0
SHA512

c589240e0eea1a938a699be40be87b6b2c9f665494187be35b657ac95eb1d9fae4938eac26acfeae4324912a01c7eb84e3c358c84e0c934b0d9289b1e72ea17a

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.udglqdyjg.emddkvlun
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.udglqdyjg.emddkvlun
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.udglqdyjg.emddkvlun

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.udglqdyjg.emddkvlun

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.udglqdyjg.emddkvlun

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.udglqdyjg.emddkvlun/ygksjkIdk6/jkh8H4f8akkoskh/base.apk.kfh6tkh1.8jj	5205	com.udglqdyjg.emddkvlun

Queries the unique device ID (IMEI, MEID, IMSI).

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.udglqdyjg.emddkvlun

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.udglqdyjg.emddkvlun

com.udglqdyjg.emddkvlun
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5205

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.udglqdyjg.emddkvlun/shared_prefs/multidex.version.xml

Filesize
306B

MD5
7506033a8e2d2cd2f3f9faa2c3ad1e0f

SHA1
6bbeecf93f4305bc23650f9ce8ff6f0bea9c476d

SHA256
cf8cf8d1d458ddae523613bb893e1433c2ddccbe94d144448f77bc1f737a1a47

SHA512
0fa95a29c4f1d49c15ceeed5664aae6240df37c567c22e4be2e34632aeb62e329017e322c9a7957e48bef16a0c528793e7ec5066ff8bdfb346843176ec90be59

Download Submit
/data/user/0/com.udglqdyjg.emddkvlun/ygksjkIdk6/jkh8H4f8akkoskh/base.apk.kfh6tkh1.8jj

Filesize
1.3MB

MD5
88210136a3750a03bacdcf26cc9d505a

SHA1
8ffe4492550a80034fef807ca7aea1f9f7f7a197

SHA256
75a96e0a179b8e373324f3425abf78f4eca8ea279a87cd923d697d98402a1e9e

SHA512
a44064c30067496bfa9e7839ba12348c3fd1d92701a5d3d25048b0693d2799462de88d616efdea81f8515028ae22e032b8525f21f405abd8f41006aaddd5f1d1

Download Submit