ermac | d74ba0cb6b7c060199a7e2e7d3925606eca6f2d902bf516feea123fd2b43eadc

Analysis

max time kernel
1309667s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
06/11/2022, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.apk
Size

918KB
MD5

7134879be9b4e2fd6b1de8b734fe8d67
SHA1

4a8f63271ed5aed3b813c0641b7f8a314fe771d0
SHA256

d74ba0cb6b7c060199a7e2e7d3925606eca6f2d902bf516feea123fd2b43eadc
SHA512

cd801eaca891bb65eb6e2141765725ef8d86886baa8a5e1fbd3e62b189ec7536a5285886d3c2a9f2ada433daf3f34e123e49abcbcfb6f17ef2748cca359419d0
SSDEEP

24576:kWR0zj34qS4IJUGJ9O5q4WiqeVIIVamYg/qvC:kWR0zj34b7eWpBmYg/t

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://176.113.115.150:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.gidanituguriropo.vahete
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.gidanituguriropo.vahete
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.gidanituguriropo.vahete

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.gidanituguriropo.vahete

Removes its main activity from the application launcher 2 IoCs

stealth trojan

pid	Process
4118	com.gidanituguriropo.vahete
4118	com.gidanituguriropo.vahete

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gidanituguriropo.vahete

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.gidanituguriropo.vahete

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.gidanituguriropo.vahete

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gidanituguriropo.vahete

com.gidanituguriropo.vahete
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4118

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gidanituguriropo.vahete/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/Cookies-journal

Filesize
1KB

MD5
61c42f9ba3e3c2d8bd7fa2242eccf6d9

SHA1
508ecf04482748c5d293fba4f859a11e38d2eff3

SHA256
3eef05cae72b8b7334164d20e204d99041b30869700f1ff87a18aaf789b46b95

SHA512
8ce9bac404b6869cd7942097fff24cd130c8f5cfe93e44a2450f53da7f301bf34b2c74b7ed74841e1e0a48bf61e047f868673f37fb1cbfeb907415057931aa6b

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
c66e753a9e3cd32e60219da5309cfef9

SHA1
dd65b15f408b41669ffa2728c56a0cd19fad94ed

SHA256
f6e08404e5bda01e3ea6368661de1856e3a36fe33591d4df3724c0836156b5b8

SHA512
7e7d99cb5e459e2aa3512d1f8c87a7c12e00158d636303b13a299601a9f9e37fdf269e9989a8073d6c07e4ef7b629c5a3ba7bbe26214c29e7d208618cf414e4f

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
b9278496ecd8ad4b56a8139fe0c66f7d

SHA1
19c608245071cd8f2c3e249d92eb0cc33fb834c9

SHA256
493b9dd4937462cab803d33b7a9028f87004824e7319bdbeb232d514ae7a0c05

SHA512
7efc70daab9b8ad48fea845c7b10fcbf402c9d65593657a925b6561bd03716d0a40e52516ee7390dcfbce15699ef7428795c200b74a95ede331d02e15553b58b

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/Web Data-journal

Filesize
1KB

MD5
0ada75d3bd70996a9ea9e0f1d2b44538

SHA1
e30b7835c5c9a72b5c6cdfbf471f118a7032b90b

SHA256
5753a1bfdb23f1bb1d345627d196d05fb8fb4c5ca4c16a18eeaa063d6644df2e

SHA512
85f571313f10c5cf72a6bfd7069512190c3609276ff0f6dceee222ea8b6b8f96f5c8eefde697a4942f50aac6e68552c25916532c236ebf0197635c9be258ba49

Download Submit
/data/user/0/com.gidanituguriropo.vahete/app_webview/metrics_guid

Filesize
36B

MD5
dbccbf6fff4046f40b61e25c2e4e7e12

SHA1
c0ad7bd7c38d768ade2b0fdf9ede72dd190e01b0

SHA256
d1772171d84c1ffe06b3a3fe88b4da1e91e3ed982ccaad22c41c254940a727fc

SHA512
3ed7871a6e41373cdd1adf181cbfdfaa23a68657359931870832af93116527595deec7afbf1b27e1eff685e0d1d35b8fe8f3fd10337c410e0ac41ad158f7b0f0

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/a63f6ad0ba0d5e6b_0

Filesize
30KB

MD5
448d530f01a4c6d3662a9b36cdbaa219

SHA1
e433910d08414ea81e979e3b9f38063e805a2e2f

SHA256
717af7bd67c45e61324510d6c8c311009e42fb68fccd6b6dd66f50c88de6a745

SHA512
c8dcdb630a755d40be7603272cf7cfba1f7acb46b2eb3e1b63176f6233a225c6de3a9c1e07123b1b6b4f299c0040b9ee32beb9f999bc14be2fa582389ada133f

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
8bde2671e6c43211297a4035dc8e7708

SHA1
509054af827ce483ce95a3301ebe8eb7b8e920df

SHA256
70ddd445e86126784fe1a135ca15485b28e35192a728d09cf3c611081b58a3be

SHA512
eeee3aa125f0b83b88179dc27ff6e1e83acf04b457e365986f6fd1de7a34d1033fb4bee945a91aca6de3c4c67b9b8815e1ac9f5aed556f4ad7eec96637a7db24

Download Submit
/data/user/0/com.gidanituguriropo.vahete/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
252666ec9b285692a148a118c27b1cee

SHA1
78b2b4bf921fdff1c82ad0147901c386f467ba91

SHA256
b08553e0835d62913c07fc0b7166fe3eb5ba9049ac6ce5a2f60e65e37d39b346

SHA512
ede7cc34c5e0a5d45665571778d30fa5a5f12ea301f550ac5e08854281c03c28bac08407b83b94cb478d70befb42005aa6a5a2a8708a6d99456714de9504d03a

Download Submit
/data/user/0/com.gidanituguriropo.vahete/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.gidanituguriropo.vahete/shared_prefs/settings.xml

Filesize
140B

MD5
c22b13acd7c7d9b8e678d8ac9250eb36

SHA1
474f64263b5e09462c3d93e26515c335709d66a4

SHA256
3a7cc7ec100093fcbac98f04fb7f6dca953de5957561b7be5f2afdbee6d61218

SHA512
c5c0dcc7f443c1a31941d94574c808e7b52e92191691809781efc0231fc9188ebb2f604e66fa50c932b174a09a380c0ec3f4b06008131357f205edd2b25e66bb

Download Submit