ermac | 106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf

Analysis

max time kernel
3316949s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20220621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220621-enlocale:en-usos:android-11-x64system
submitted
22-08-2022 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf.apk
Size

2.6MB
MD5

5f9448f26eefdcb7a0efd580e986426f
SHA1

6a3b4c784e4c08db5ec5d265f935033c8b105949
SHA256

106de90d442cb9a1a8d6bf3b83628b9902a3caccce082ee0fadc87159a282aaf
SHA512

d2ab78caf5faca3f5274da78147217d2974b759100cfa37f9875280606f025d3609cb4166bb4822e081de34496dd48c4f64e8e3653c5c07ecb905a2f443b5272

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/5138-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.jakedegivuwuwe.yewo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.jakedegivuwuwe.yewo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.jakedegivuwuwe.yewo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.jakedegivuwuwe.yewo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.jakedegivuwuwe.yewo

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json	5138	com.jakedegivuwuwe.yewo

Queries the unique device ID (IMEI, MEID, IMSI).

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.jakedegivuwuwe.yewo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jakedegivuwuwe.yewo

com.jakedegivuwuwe.yewo
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5138

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

Filesize
456KB

MD5
2717a78a56c59dd1c7a5f00f2b1034dd

SHA1
285d453206526cf8a2b91567f8fb4402be3e04d0

SHA256
45444c9c760ff24b43b89ba3d397cc946e276722460be977f59a1b44d9e1a18e

SHA512
2a52b2f1b49fbaadda91a506b2c931b789fb6ba3fe966c59b9a40d336d1fc576472117d4ae0554dd451049286e4eca3bd95829c42dc3389602244cf510757a2d

Download Submit
/data/user/0/com.jakedegivuwuwe.yewo/app_DynamicOptDex/Axgj.json

Filesize
898KB

MD5
c7cb909c28565cb4932ccb19953c4375

SHA1
da8f0300b37c4cd3428cda66cc64ff7ef4959549

SHA256
7c501b0f8f6b4527c828d4af534f685abe4bebe566691af5a439587c524875f6

SHA512
3feefd7d2a37f85887e5135e526847cb835c89879c49df4a2c171707fa1605018dc1311c05534491d38dad7d1a70ae6f8c1426d65fa73445904e409c8685912a

Download Submit