ermac | fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8

Analysis

max time kernel
3293812s
max time network
165s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
22-08-2022 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e97091787df05f9c69fc18529246829.apk
Size

4.2MB
MD5

6e97091787df05f9c69fc18529246829
SHA1

8b7fd675d02ddf94a9141842252eb54993ce3f6c
SHA256

fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8
SHA512

b90877a306774f3a41a371b03d04e8b64e8cf10fa500a3312ad1b53c2152ac1345bd3e439f7e47b75ac7a3728f71e41c77400ee50642d66c86a007a7fb37c04d

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.doptdtvwg.yhhisqauo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.doptdtvwg.yhhisqauo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.doptdtvwg.yhhisqauo

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg	5284	com.doptdtvwg.yhhisqauo
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]	5284	com.doptdtvwg.yhhisqauo
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]	5284	com.doptdtvwg.yhhisqauo

Queries the unique device ID (IMEI, MEID, IMSI).

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.doptdtvwg.yhhisqauo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.doptdtvwg.yhhisqauo

com.doptdtvwg.yhhisqauo
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
/data/user/0/com.doptdtvwg.yhhisqauo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
88b02045e4387f395c16f7940a81b805

SHA1
a7fa5ce96e947c9f2462fec8726a69a6a25e6e23

SHA256
e8f1a522d7e71262ccf4698c73060018aa9e04e71d8c89748e94bb260aad7b92

SHA512
f282d911c84a3ebec566df4a873921534e8c0c54c28ac16df45dab329d7c18bff6bb554b25bf0bae07ce3326c58d08a25a1af594eeb021cde966300e38611fca

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit