ermac | fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8

Analysis

max time kernel
3300437s
max time network
161s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
22/08/2022, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e97091787df05f9c69fc18529246829.apk
Size

4.2MB
MD5

6e97091787df05f9c69fc18529246829
SHA1

8b7fd675d02ddf94a9141842252eb54993ce3f6c
SHA256

fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8
SHA512

b90877a306774f3a41a371b03d04e8b64e8cf10fa500a3312ad1b53c2152ac1345bd3e439f7e47b75ac7a3728f71e41c77400ee50642d66c86a007a7fb37c04d

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.doptdtvwg.yhhisqauo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.doptdtvwg.yhhisqauo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg	4873	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/oat/x86/base.apk.Uyfkqyg1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg	4825	com.doptdtvwg.yhhisqauo

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.doptdtvwg.yhhisqauo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.doptdtvwg.yhhisqauo

com.doptdtvwg.yhhisqauo
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4825
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/oat/x86/base.apk.Uyfkqyg1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4873

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg

Filesize
1.3MB

MD5
2603332f2040f91f411e8f92e783f7b7

SHA1
fd2bcc7389c82865ab55cb347e43db50885ae2f1

SHA256
90a3defe3e8411b55d9903dd6c6128ab54c1b0709dc4fea0445adf003f083d49

SHA512
133ae437e1c9cf2781b09c474fc57fd7156b3b090f6fbcb53af9ccbdd584efc8533efff38e74fa90057a7a15c02217d9178a4300cf08edb0c9141177644b7b71

Download Submit
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
/data/user/0/com.doptdtvwg.yhhisqauo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
f38918c1a2c4f41a992675d9d5e7ac23

SHA1
a85ac361577f86a8add88ea984dec0158b8a7236

SHA256
0a0e43a1a07ef0fbcfe784b550d52be442fe5ccf3e8368c8a2d07f603c55213e

SHA512
7bf475e34a972e159b43c1fd0f062327e30efcd6479d0f36452cbf8ec711057eb9817e4aed7cc71e3bec3e29d0842b12cf3856fa39e36fbc9a997b346f802aff

Download Submit