ermac | fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8

Analysis

max time kernel
3300541s
max time network
164s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
22/08/2022, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e97091787df05f9c69fc18529246829.apk
Size

4.2MB
MD5

6e97091787df05f9c69fc18529246829
SHA1

8b7fd675d02ddf94a9141842252eb54993ce3f6c
SHA256

fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8
SHA512

b90877a306774f3a41a371b03d04e8b64e8cf10fa500a3312ad1b53c2152ac1345bd3e439f7e47b75ac7a3728f71e41c77400ee50642d66c86a007a7fb37c04d

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.doptdtvwg.yhhisqauo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.doptdtvwg.yhhisqauo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.doptdtvwg.yhhisqauo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.doptdtvwg.yhhisqauo

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg	5304	com.doptdtvwg.yhhisqauo
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]	5304	com.doptdtvwg.yhhisqauo
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]	5304	com.doptdtvwg.yhhisqauo
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]	5304	com.doptdtvwg.yhhisqauo

Queries the unique device ID (IMEI, MEID, IMSI).

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.doptdtvwg.yhhisqauo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.doptdtvwg.yhhisqauo

com.doptdtvwg.yhhisqauo
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
/data/user/0/com.doptdtvwg.yhhisqauo/shared_prefs/multidex.version.xml

Filesize
307B

MD5
6927ca5dae034e9d2a7deade29567127

SHA1
7fb40e5fa272ee4e62a89d66e861b1f4a37254e0

SHA256
84fe5aae22cefa0059e6067de079f6d65b6e0f95542ae2721669b1627e1537ff

SHA512
3e0e2d74b1aae17f68f5d37199f6f76ce1266ce7a4c925f852fc41b69bd435f57c7389be46dc924dcd2bb84cedbbc687ee54f41f4cd83a97ec254bb4a76b0b99

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.doptdtvwg.yhhisqauo/bIp8fgIg6j/b5kkygp8f58huog/base.apk.Uyfkqyg1.hhg]

Filesize
1.3MB

MD5
63d5c5dcfb74dfa9586817ca5f2ae741

SHA1
92cba0909b54f466df279438db857dd4ce42f1c2

SHA256
1e2c2c1fa2ab9a0e70e495be75f718ddb995413bc3a27eb58397985213a51a18

SHA512
112f4379cbb2026ef1fcdd0a996fb52aaefd62cc0cc8fcf86003f56ba22bea6a8b20e34d4252821e72ed54031588c45d7bdebf3824d7291047a66a3ec7f1f484

Download Submit