ermac | 23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce

Analysis

max time kernel
3986007s
max time network
166s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
30/08/2022, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce.apk
Size 1.5MB
Sample220830-hxmswsddgp
SHA256 23ee361d76bfff1a8cf2dd40160e48a1e0ebd171905d149096de694427ee68ce
MD5 548b51ca14154fbd6f13b7ce97802020
SHA1 9fe55567e69413b5f49af51121c05fc2515d8364
SHA512 e9a1867c81fb1d75ac152025e08308b7910a65ec430a2382555fe7ea0e2e20c7bc0f42d6d2dbdf359ddec5f987769ec1975d1a75b5e31f8f0082a017ee2fabec
SSDEEP 24576:DtZAIzFHDjOTr4fwWt6kk0dQcsLKOr2oCndN0eqxqyuMjxz2uelu363C6l:xbzlK/4f16kO26eWQ73C6l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ermac banker infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/4945-0.dex	family_ermac2

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json	4945	com.yusozofasuga.dadoduva

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yusozofasuga.dadoduva

com.yusozofasuga.dadoduva
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:4945

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

gLKsqo.json

Path /data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json
Size 451KB
SHA256 c0d33f70ce1906ee68d0438cef8147d51854a22297988635b6e7669008e9eefa
MD5 c373a9c922dfd38ae95052d9b42b806d
SHA1 e9dde6b9f42e4ab98f467d30b4aa50899984ae14
SHA512 eefa473020a6d0d7e25ce81ddfb07f83005ffbef9da0ea7dd0967eb894e6706555e33cf18f3d3a282e15bdef893d896dcac1f4f33f0a10be75ce4260cc854ea8
SSDEEP 12288:q4xjNX7GemWC5qoleHGVNXx/tksdeIyVyJTt3R:NNCeq5qoiGfx/2Oetst
MD5 SHA1 SHA512 SSDEEP

Submit Download

gLKsqo.json

Path /data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/gLKsqo.json
Size 890KB
SHA256 7d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e
MD5 ab16e04b52e006b2f1317a485000359f
SHA1 dda556bcecd7e19fee1735fa10562d898452ecbd
SHA512 ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699
SSDEEP 24576:TdLulQg2xYCPfMvidZLOPQC3Q3yngMXOGa:T2HKjPmiddcQCwn
MD5 SHA1 SHA512 SSDEEP

Download

settings.xml

Path /data/user/0/com.yusozofasuga.dadoduva/shared_prefs/settings.xml
Size 138B
SHA256 2348227481c31a02a19cc2470c337ce167aef1aeafed1a7a422c984de0ee6d57
MD5 f667e0f82295d0aa77ea11108569a1bd
SHA1 9292fcc859847dde46951cd27094a703163b2c89
SHA512 0d16a0591d2d7e7305d440a6b894199e426e64c6637a3847b737e8cb9b52807eceb7a4ae84c1263137d1a5feb0132a9a420364989f9c5a5b7e5bbc4e68c0dbfe
MD5 SHA1 SHA512

Submit Download

settings.xml

Path /data/user/0/com.yusozofasuga.dadoduva/shared_prefs/settings.xml
Size 182B
SHA256 92391917e8a542c01a35b7b78acd601880e39f24ec349e4225baaa0f7d76dd81
MD5 8b4198bf5d5262dc59ea81dc0eb48063
SHA1 b45aaa889b1e76b40a758f7a9fd658ef49cf117a
SHA512 f8cf8da4f89e5577ee3af5f306ff9f8c70a3f820669ed51093551d5aac96add69ea1da8400354dd63f5f0e64cb55c99723668ee96e3270e058b92f38c6ce6e2f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads