ermac | c6c30839e1e885d4a54fe9d8d3a68b3e1c79e27e15c9a76907ba58a954d8476c

Analysis

max time kernel
3418142s
max time network
154s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
12/10/2022, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6c30839e1e885d4a54fe9d8d3a68b3e1c79e27e15c9a76907ba58a954d8476c.apk
Size

2.8MB
MD5

24b1ce69f7066a7bc9bc32e3c969d8d9
SHA1

f36ff949217f3340a717a0e5a4d079b254b876be
SHA256

c6c30839e1e885d4a54fe9d8d3a68b3e1c79e27e15c9a76907ba58a954d8476c
SHA512

d0ef9542547fa0ad59facd30ed4ee2b18e5db8ba98ec87ef6585182047f8dd070d8ded12c9e0e1d8b9bf36b67e395dd0d78028d0e33a4f269ce6e9e015627367
SSDEEP

49152:kQrHl7Y+DlqP9DGrd7Rr4f+D3A7Mu2az5Umfu6VoBlmF0kotnITqK:kQrHhY+D4P8FRHD3A7bKmfXVUwF0kebK

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://31.41.244.187:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4139-0.dex	family_ermac2
behavioral1/memory/4107-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zixudahitifo.gicu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zixudahitifo.gicu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zixudahitifo.gicu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.zixudahitifo.gicu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zixudahitifo.gicu

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json	4139	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/oat/x86/ZnXAwQI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json	4107	com.zixudahitifo.gicu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.zixudahitifo.gicu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zixudahitifo.gicu

com.zixudahitifo.gicu
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4107
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/oat/x86/ZnXAwQI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4139

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json

Filesize
444KB

MD5
4d3809f5a4fef02c10481b9b1b1d99ae

SHA1
98c904448966a87ef716c54059a3f5d3b742e89e

SHA256
7293c3bd06c36eff25632488bd2d84d0b22917a14bece9464fd777177ffe2ee2

SHA512
3735cf0d6407590551a60767315a199d546114ff7b78102ad4ba346807f2a3196ee7cf09b219a9f66df46c9adb271a1f86a4fb580e5f29bfed05374e7895d731

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json

Filesize
911KB

MD5
7f25ed7ecc620c873c4a3131cf0c4e1a

SHA1
085e44c52a281d59ae656019af820cc3fd718847

SHA256
6417a5e83c7854973a7cea8e1078b5a8774c4a1e96154089b11cbe92fb7e4ae3

SHA512
d786a40a646e81dfade62fcb0b416ef9927f8e83ab2ad7bfc0cc71cb23f5fec9ade856f6e525f9c93b6ec262ce1f2c0988445ad676ef68508c7e9753b3ae3b13

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/ZnXAwQI.json

Filesize
911KB

MD5
c16712257cf7c12470bf2a199b0cd54f

SHA1
ebf57d2d80e6ad46d45a0eb84b8e59d8dffbd5ff

SHA256
432c766cb9e36d58b08319a5beb7f0176b394be06c6778f9bd0c6e23a3b81365

SHA512
5b9f365575f22faca096230e18e508128ce728c8c9acdf0bd7f86b1f39e145d402b8ba574c497835e788a2ed500737decf49a635c1ff936061ea412187a0bb12

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Cookies-journal

Filesize
1KB

MD5
64078defcf9c88ae52b3223cfacb5da2

SHA1
bc4af93fb17b98919e475c9471c6a9dc52681f6d

SHA256
c0c904d49af93498ccff687438dad97d677c4526c1836970993c1d4dfdc469ba

SHA512
f497c1c9798c157f759db866d6f8ac34dc69be803f2c21c9ebdec0d7eee3129fbb24d573062bf99c850aa3a54644ebde807a860c21cc9e9285dde6bef52567ee

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
147465089af7c0a4d5fca71e8c3353ac

SHA1
30158e471856496d986b1e13f0b118ba04574968

SHA256
b7515cfc23edeca7acab32a1a6af67c9881b5b0ced0648b3c19fd495460261b0

SHA512
85423db2abce09c129fb4b52fce8df7c0738d34b717062b797cb98e4323403da76351d3f091df62e3d6015e3ca689de4d30697e35bffadc7307183ddd3fbd6fb

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
6766c000e513bd549913c229bc73eec6

SHA1
eaa26846f450e36d5b97d995f6e9f1565fa6c5bf

SHA256
eb6c02423da2532ef2a580d23e13335a286aa0507db01115b51a3dd547e8183d

SHA512
eb68b2cc1f4c9e81dcc0465226e55d7b095861bce3a05455d605ba5cedd8daf1ba31241e3ae7444bbe0963ef989f01ff4837372d74976ac5903b5da995d2decd

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Web Data-journal

Filesize
1KB

MD5
515177a0b45b0c2899759609afd8db10

SHA1
f682be8be0f03dc65cda00978eeab6ef84763be4

SHA256
639f1554ef58a333aba099c8be644a7068e4447f36304554a4cb21e1a9469e83

SHA512
12f423c790f2ea4acc643fe8a35097c2117cf5667bd0942983c812ed9bb69010896eaf1fbdb78703b3c8d653d5bb41c9765d391d6c24454378db70436851c8ba

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/metrics_guid

Filesize
36B

MD5
4b253ce68267e3035ff51b7c5f9fc45b

SHA1
9c5e4f55ec397df6c6c0dffe456729bac6118e36

SHA256
3aa88366633ff34bc26b9f8d7014dfba687ce4113fecddbcae034b0ed62bbf19

SHA512
6b70a06491e446a7d2a66fab2469e2744d7f8d5929d4971a6d9acc1a95554c6dc59dee6fff657497e32a0d306369483d1e1a9e6e646a10cdc01005e9b1340188

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/a63f6ad0ba0d5e6b_0

Filesize
30KB

MD5
4324d0d1fd9ac31b48ea2354b9c7ae12

SHA1
5c2ae33c36a642f9bdb1395d4045961d5be6cdb0

SHA256
4809b9188c41c8c162dbb08e3ed7065e6516513cd0fd42124b1fe527815df19d

SHA512
38e2e4554ec0f04f4863f708c7526529cbb4651458adb7cf4019280096797c35e3eea1a6eb7bd6b1e0e046759c80fb6d5447a6335bd4f2525efc38240a94ac72

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
999abc2b69ef11a1764ee1090a0b507d

SHA1
7c5600685a0c6a74701ffdb0cf834886cb3a7b38

SHA256
7fa4bbf0942f9daf123764c8cbd165a46d20acffa97dcb0e3763e11cd34d784c

SHA512
0f5e0c258aeb6f719a47ee849a392f225ee1b893f3835d6d3a6c8bace3989dcc4ce40f512ccae19d8e429bd29e834905501aa76fa477a7d47b6ff999cfa03c26

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
dc501e54297882f21d2147ebe77c2f3a

SHA1
e77455054903710e7a302258bd88d6d8ea989478

SHA256
ef6381690159ebe1faa0f3a3d38c9a511b1d9aaf1c6af72ed2fdddc6ef23d4a3

SHA512
95ee6bfc8d7e86f35962bf3a3a928365a26d38d26637d6cca67262b4a56c57d5181e39d84eaa8c25e0575ac3b2f6a98709c47add954634c20a16495e2681454f

Download Submit
/data/user/0/com.zixudahitifo.gicu/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.zixudahitifo.gicu/shared_prefs/settings.xml

Filesize
134B

MD5
f770197dee8ab5ace13f325d8f7999fd

SHA1
c199cc8f2bc121a6ddb8d2b61922ed4c3797995b

SHA256
a98f1264aab26b21d005fecbb0db2e746bd2b24ae04c3dbae162f6436206e3cc

SHA512
de3ab342f0b02ab96e97bfc25a73dd250f4d699517b78b5a89d62ea2c136598046173f4b49ca3060b05b077420e26682eb0f1bbd2d1855f06331cb9180920897

Download Submit