ermac | a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1

Analysis

max time kernel
3658716s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
15/10/2022, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Telegram.apk
Size

2.7MB
MD5

035a2266813f3d204c64b7be514f913f
SHA1

09ce3654ff984682c917d1b37c28d245f771a6c0
SHA256

a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1
SHA512

73a6016d7ddec0102f4621f05940dd3103264295fb45c5073ba9dfc2576e903f7dc3828fa21defc8174ea14e0397242afa4fd1812e137c1d19eb5f9a69ab5112
SSDEEP

49152:xWrpqJ2SIjTsnRQ96BVMZlf4fcrkDTCv5ZsOzrdtGiZjKNlNs:epqgS0q+g22C7zrLGSMlNs

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4116-0.dex	family_ermac2
behavioral1/memory/4088-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.loloxitohuna.pitogoxa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.loloxitohuna.pitogoxa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.loloxitohuna.pitogoxa

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.loloxitohuna.pitogoxa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.loloxitohuna.pitogoxa

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json	4116	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/oat/x86/wlrjatm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json	4088	com.loloxitohuna.pitogoxa

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.loloxitohuna.pitogoxa

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.loloxitohuna.pitogoxa

com.loloxitohuna.pitogoxa
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4088
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/oat/x86/wlrjatm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json

Filesize
456KB

MD5
4c861f23b48c50285d3fe240a336950e

SHA1
527cf74f4f20ff2afd67b8a0ac04fa83b7bcb9c2

SHA256
6604888c866c79aeebc4a038dc7d5ebf652037d4de71659f96f84f2193dde5fa

SHA512
428f65798ce60ebcdc3bab385471cf7c0b2531ec52dfe21cf446808902580e4b477c4f75a404dbf8aa2bc5443683a5b8c0550322262c6c23fd0f89c64bc954fe

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json

Filesize
899KB

MD5
082fd060722191bdeef9592c7dba7c83

SHA1
967840f99c1920417a88bcf27f0831111b1aae50

SHA256
373b44f3435c3c1994299beba15c903518331760ec02abc8beb42951457460ee

SHA512
5987e106ada8244ea3f3bf0536d9ebb8c1e4a84faf75d973c4fb94b1a55739d980539d2e95aef0ceec0f099325c0ca7eb971823496e49338798d26c578e38b47

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json

Filesize
899KB

MD5
2149d0e1c412d8a5e22b955a46ada4d0

SHA1
e9bf7faa4653613f261e1539373959b83c4346d1

SHA256
4c9091f9d6538bba4c53ce557b5ef35f47c86faad03fbb9b001232c70960a1ee

SHA512
3c8922374b44932ad16093b25688e650a2f255d2a351ce8db1e6ac9991df122b66ae414c5887322424cc6ddc8f5c676e775515313096611c9f60382a8f88809e

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
c116fdb83d665d41f8bbef12ebcc261a

SHA1
5d8d95c58c7e7f8fd9d4f47d331c36acf5ca0ad9

SHA256
64aab1e31f25a5af37ae0afec94e6d24e96f54993cd303d84b54ada2ce27075c

SHA512
bf5171e1420fd7e568017ecabbb1143c9afcb551e6d872ca3c7e9706550582b04b3d36af3f471d90a15ac3bcdf9fac67e989212aa653d88b9556dc89d671b3b7

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
07f52171eab2a6d701e3f6da3f98d8ad

SHA1
e6f04386be72114a2136b154d2cb528ef7a50650

SHA256
c3aad3ce416d2a69c99077f83c9390ada46e756374f4ef9a0e88868eea448805

SHA512
f8ed61eba08ff4b3ecc07d9756cf18d57d293e229c98ae0e2dc58cfc7d0cc00ecfa190a5a9f0e8df70afc62417136155e1c0f55898eb7310844fa799c4f72efa

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_webview/Web Data-journal

Filesize
1KB

MD5
3c8849290efc4179c2dcfe9c8cac32c5

SHA1
95c1a059358debe22127328cc777a6fae3d92486

SHA256
702b07330c2b90a84cb7afd4559739cbbc775405ab2e471b1347037ee56e3414

SHA512
699260f12691360fc15abb8820716e381fe996a921ae78f8464e69aac0b0f0c1cb70840e92a152fdf654aac4b6e7d0070db640f7bb5abb64f45b67051aa3c6d9

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_webview/metrics_guid

Filesize
36B

MD5
8e39ecbda9434030b8691f94e86d0921

SHA1
8fccc10b86695af3af8564cf1eec89139f897b30

SHA256
74fcdc8c663853f3443fbb5a0ee66d304bdc8a66ff1e540edf02cbc5259cd2de

SHA512
1b7970515f9dc34e62d84a659d0baf18a984ba074558de137a9e429e198461e34136dda3212070dc7e3c1bb296809e1d50d0942f928d3a537c04f8081cb80bb6

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/shared_prefs/settings.xml

Filesize
138B

MD5
c900c437e050a0a0975fea7d59ffe9a8

SHA1
43906d1111416d71b5b6c9ad13b3261c29497853

SHA256
b502542eb45bbc35c5518d6afe55aef84d95663cd0a781ed119c9d0f04356460

SHA512
4e4230f4b9382797d721a007091a04c1012f2e3542ca371633ca4d2432512210f1794ca5adec586032e728fdb0ebe511fba74ea7b94ea1c2c820564f67b1c595

Download Submit