ermac | d6299da308a53c7bb6ac4ab52fd79e1732c67c39b55b7fa5e5c581b1eb15f2f3

General

Target

d6299da308a53c7bb6ac4ab52fd79e1732c67c39b55b7fa5e5c581b1eb15f2f3.apk
Size

2.0MB
MD5

e16a2e97078de0749a6be9a2504b1025
SHA1

b669aa8644884829c1b5b796ac72308697c2655f
SHA256

d6299da308a53c7bb6ac4ab52fd79e1732c67c39b55b7fa5e5c581b1eb15f2f3
SHA512

acd57cdbe152de795cf47f589cb29671b8a2538acb83d4e076368bba3035353a68acd424b05b39356d0c7bf3042a0ee48f29ca4d0e3d9cafb5d37f6d944a2be5
SSDEEP

49152:0Vc4/V5nXH4f6hhL9m1RYZr3ZvKzfUKwQYKJ0:wcYnXRpYYhpvKQSYu0

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

C2

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4206-0.dex	family_ermac2
behavioral1/memory/4158-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yusozofasuga.dadoduva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yusozofasuga.dadoduva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.yusozofasuga.dadoduva

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yusozofasuga.dadoduva

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json	4206	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/oat/x86/pBxY.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json	4158	com.yusozofasuga.dadoduva

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.yusozofasuga.dadoduva

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yusozofasuga.dadoduva

com.yusozofasuga.dadoduva
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4158
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/oat/x86/pBxY.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4206

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json

Filesize
451KB

MD5
1a017ad50f8d159b9a948c171637c734

SHA1
37acad4eaf6d0a8b4d83339b44a789dbce145091

SHA256
8fc437dc0501819de410434c1ae6bf8d00a5db69e8013b00500eeb71568c8e3d

SHA512
9ac8dbbb660aef623b01f9599f4c813dcf52529776cef3d9669989a93c0df7eb29f783850300d6e6dcf70b638b0be2afd21c0be9c7a25932b8511ef67d7a58f2

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json

Filesize
890KB

MD5
4b3296f3dc431545736e917509ba82c9

SHA1
d57bb111ed9af2804db007adc358dc3e6bae7e0b

SHA256
17731dc7e3b784fed6392476296050ba62a4423bf3b9dcb5758fe4930ce66315

SHA512
c6aec0e423e5c78a74c2e0de8550303e59990a70f56bf51390ee4083b7ed8ab7de41df0558812854e4f9f78bc0ba45cf78458207e053dd6d346fa49855f2c47b

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/pBxY.json

Filesize
890KB

MD5
ab16e04b52e006b2f1317a485000359f

SHA1
dda556bcecd7e19fee1735fa10562d898452ecbd

SHA256
7d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e

SHA512
ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/shared_prefs/settings.xml

Filesize
138B

MD5
f667e0f82295d0aa77ea11108569a1bd

SHA1
9292fcc859847dde46951cd27094a703163b2c89

SHA256
2348227481c31a02a19cc2470c337ce167aef1aeafed1a7a422c984de0ee6d57

SHA512
0d16a0591d2d7e7305d440a6b894199e426e64c6637a3847b737e8cb9b52807eceb7a4ae84c1263137d1a5feb0132a9a420364989f9c5a5b7e5bbc4e68c0dbfe

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/shared_prefs/settings.xml

Filesize
182B

MD5
8b4198bf5d5262dc59ea81dc0eb48063

SHA1
b45aaa889b1e76b40a758f7a9fd658ef49cf117a

SHA256
92391917e8a542c01a35b7b78acd601880e39f24ec349e4225baaa0f7d76dd81

SHA512
f8cf8da4f89e5577ee3af5f306ff9f8c70a3f820669ed51093551d5aac96add69ea1da8400354dd63f5f0e64cb55c99723668ee96e3270e058b92f38c6ce6e2f

Download Submit

Analysis

Sharing