ermac | c681ffcfd808a31fa2061c505824dfd3aa0b488b1a4f356dc74aad35b556c896

Analysis

max time kernel
3986051s
max time network
184s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
30-08-2022 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c681ffcfd808a31fa2061c505824dfd3aa0b488b1a4f356dc74aad35b556c896.apk
Size

1.7MB
MD5

ad5c64ecb9d4d0cc55d3d28ce6d74cf5
SHA1

f5eec31be9de22ba2189b82b95c38ebf36d832f2
SHA256

c681ffcfd808a31fa2061c505824dfd3aa0b488b1a4f356dc74aad35b556c896
SHA512

34416a74ec97608e8e9aaa252314757204149cd986d98ac3a4c3c2ef3ba0903f05901f9eeec904aa19a8629032702b23d52f6f8cb75eeb2a6509db3f8fb54280
SSDEEP

24576:6qXR/4N9aIyYcWa4fwaIGJgUQQksADiqeRytdkP2yOf0TwsEVU1poT7/MWcQPAwj:XNcaIO4fgGJggAdkP2ynubT7kZ87r

Score

10^/10

ermac banker infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5071-0.dex	family_ermac2

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/uuFDIL.json	5071	com.yusozofasuga.dadoduva

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yusozofasuga.dadoduva

com.yusozofasuga.dadoduva
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:5071

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/uuFDIL.json

Filesize
451KB

MD5
57ae9253af1f31c753df43095bfb8866

SHA1
d518f04a0c7cb203a1a69ba8e4cc8a218986a043

SHA256
68634906cb485eb79afb0068f75621f2b62df50d1a22999d13b9b3da8a0b73e3

SHA512
5af9fad1d9b36aeb2f2c1c0dc73a52e48f0335ad38353dcbef56b39464ac931ce82d12a590805251812edc5d416b6833468a6686589045820bb827c9dfbaeea0

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/uuFDIL.json

Filesize
890KB

MD5
ab16e04b52e006b2f1317a485000359f

SHA1
dda556bcecd7e19fee1735fa10562d898452ecbd

SHA256
7d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e

SHA512
ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/shared_prefs/settings.xml

Filesize
138B

MD5
f667e0f82295d0aa77ea11108569a1bd

SHA1
9292fcc859847dde46951cd27094a703163b2c89

SHA256
2348227481c31a02a19cc2470c337ce167aef1aeafed1a7a422c984de0ee6d57

SHA512
0d16a0591d2d7e7305d440a6b894199e426e64c6637a3847b737e8cb9b52807eceb7a4ae84c1263137d1a5feb0132a9a420364989f9c5a5b7e5bbc4e68c0dbfe

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/shared_prefs/settings.xml

Filesize
182B

MD5
8b4198bf5d5262dc59ea81dc0eb48063

SHA1
b45aaa889b1e76b40a758f7a9fd658ef49cf117a

SHA256
92391917e8a542c01a35b7b78acd601880e39f24ec349e4225baaa0f7d76dd81

SHA512
f8cf8da4f89e5577ee3af5f306ff9f8c70a3f820669ed51093551d5aac96add69ea1da8400354dd63f5f0e64cb55c99723668ee96e3270e058b92f38c6ce6e2f

Download Submit