ermac | 106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf

Analysis

max time kernel
3316837s
max time network
148s
platform
android_x86
resource
android-x86-arm-20220621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220621-enlocale:en-usos:android-9-x86system
submitted
22-08-2022 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf.apk
Size

2.6MB
MD5

5f9448f26eefdcb7a0efd580e986426f
SHA1

6a3b4c784e4c08db5ec5d265f935033c8b105949
SHA256

106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf
SHA512

d2ab78caf5faca3f5274da78147217d2974b759100cfa37f9875280606f025d3609cb4166bb4822e081de34496dd48c4f64e8e3653c5c07ecb905a2f443b5272

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4629-0.dex	family_ermac2
behavioral1/memory/4547-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.jakedegivuwuwe.yewo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.jakedegivuwuwe.yewo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.jakedegivuwuwe.yewo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.jakedegivuwuwe.yewo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json	4629	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/oat/x86/Axgj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json	4547	com.jakedegivuwuwe.yewo

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.jakedegivuwuwe.yewo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jakedegivuwuwe.yewo

com.jakedegivuwuwe.yewo
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4547
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/oat/x86/Axgj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4629

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

Filesize
456KB

MD5
2717a78a56c59dd1c7a5f00f2b1034dd

SHA1
285d453206526cf8a2b91567f8fb4402be3e04d0

SHA256
45444c9c760ff24b43b89ba3d397cc946e276722460be977f59a1b44d9e1a18e

SHA512
2a52b2f1b49fbaadda91a506b2c931b789fb6ba3fe966c59b9a40d336d1fc576472117d4ae0554dd451049286e4eca3bd95829c42dc3389602244cf510757a2d

Download Submit
/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

Filesize
898KB

MD5
c61c2c36f02d23dc18d11665d17d70e7

SHA1
206dc91ebde52e6f667466a7122a00a3ccadf3b2

SHA256
adaea6569b65a3f4dc1ec4ec66281831a199645d1847a2960047329e0b6fb532

SHA512
abca2724fe971a8c59d0c172f2fa3b85696423eb80a2c8254600b6b7464ae70534236646efeea7cd321c95539b79cf97628588c386dcf5085f6405601e798573

Download Submit
/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

Filesize
898KB

MD5
c7cb909c28565cb4932ccb19953c4375

SHA1
da8f0300b37c4cd3428cda66cc64ff7ef4959549

SHA256
7c501b0f8f6b4527c828d4af534f685abe4bebe566691af5a439587c524875f6

SHA512
3feefd7d2a37f85887e5135e526847cb835c89879c49df4a2c171707fa1605018dc1311c05534491d38dad7d1a70ae6f8c1426d65fa73445904e409c8685912a

Download Submit