ermac | fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8

Analysis

max time kernel
3293811s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
22-08-2022 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e97091787df05f9c69fc18529246829.apk
Size

4.2MB
MD5

6e97091787df05f9c69fc18529246829
SHA1

8b7fd675d02ddf94a9141842252eb54993ce3f6c
SHA256

fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8
SHA512

b90877a306774f3a41a371b03d04e8b64e8cf10fa500a3312ad1b53c2152ac1345bd3e439f7e47b75ac7a3728f71e41c77400ee50642d66c86a007a7fb37c04d

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.doptdtvwg.yhhisqauo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.doptdtvwg.yhhisqauo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.doptdtvwg.yhhisqauo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg	4760	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/oat/x86/base.apk.Uyfkqyg1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg	4726	com.doptdtvwg.yhhisqauo

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.doptdtvwg.yhhisqauo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.doptdtvwg.yhhisqauo

com.doptdtvwg.yhhisqauo
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4726
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/oat/x86/base.apk.Uyfkqyg1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg

Filesize
1.3MB

MD5
2603332f2040f91f411e8f92e783f7b7

SHA1
fd2bcc7389c82865ab55cb347e43db50885ae2f1

SHA256
90a3defe3e8411b55d9903dd6c6128ab54c1b0709dc4fea0445adf003f083d49

SHA512
133ae437e1c9cf2781b09c474fc57fd7156b3b090f6fbcb53af9ccbdd584efc8533efff38e74fa90057a7a15c02217d9178a4300cf08edb0c9141177644b7b71

Download Submit
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
/data/user/0/com.doptdtvwg.yhhisqauo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
938d137545b399c0f6ba7fb720fda4e4

SHA1
adc2dc71dfe70929e154c50eccd7155cb61ccaad

SHA256
32816a59a248281b7f11068963008b52e0d9cae7379f760e6dde031717fb91d1

SHA512
4201ac410ed486d32455f3e05b954c2446d98d0df9dc7b3da74c917a255c6c6f82f057bb404f6c311b0560e5c0c993b6b703aa9ef003c8d3ed173bff631df9fc

Download Submit