ermac | 5a29d563c11dca7d605d426c3269e75682b215d10cf5682b4c8044d5a34b501f

Analysis

max time kernel
1462228s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
08-11-2022 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5A29D563C11DCA7D605D426C3269E75682B215D10CF5682B4C8044D5A34B501F.apk
Size

3.5MB
MD5

f56d57be9f495615154236c98c58c5cc
SHA1

91a8d4482312ff2ac04b218789d4c18030610b9e
SHA256

5a29d563c11dca7d605d426c3269e75682b215d10cf5682b4c8044d5a34b501f
SHA512

3b45f6152aaf461ad00a2de8a1e2bed7faadcddba9aea71950b4d10b027e3b9837de7d555a1d93128a733c0e59c418b7ae62f733262a5cacdea0b4bfc9acf090
SSDEEP

49152:P7MG0Ebz89nLkrTrp9FuuCC1DsgbV56VNmR1RW6Ndq33Hau13patLvxUlgNuFFM+:DM6zakfrD8uCQ562186Tq3beVJqOKF9

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4249-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zejabimebenofe.ledido
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zejabimebenofe.ledido
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zejabimebenofe.ledido

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.zejabimebenofe.ledido

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4249	com.zejabimebenofe.ledido

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zejabimebenofe.ledido

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.zejabimebenofe.ledido/app_DynamicOptDex/jfy.json	4249	com.zejabimebenofe.ledido

Queries the unique device ID (IMEI, MEID, IMSI).
Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.zejabimebenofe.ledido

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.zejabimebenofe.ledido

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zejabimebenofe.ledido

com.zejabimebenofe.ledido
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4249

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zejabimebenofe.ledido/app_DynamicOptDex/jfy.json

Filesize
455KB

MD5
a5fbe07462fdd82c518c287681008e21

SHA1
2c70a7f77acb57839e92574bcea6c38ec5d0dcd7

SHA256
70f7c69c69e50e45b08f6689f6cb9571c51595cf268ecb01cd1c35a28e7bdddd

SHA512
f2555b0889779e28b39cb1fe841c359a222fda1c3a3427c948527ea06ca55ccce6d3634ad6665fa89141e422e82c7720e61889d91fdadaa4698a5ae955c4f31a

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_DynamicOptDex/jfy.json

Filesize
899KB

MD5
0fb1393e0f8689ff53eeac71986184b6

SHA1
28f19e22592dd47aad2a675c7c25fb040eca64c7

SHA256
ba84f3df748fd4a7ca47989e04b94b69b0a295a46f04011a982aff068783902d

SHA512
768d5edd17f65fbebea80631960648d2475074377b8aba285dd5c5b8f027362f47327e1e4d5f2b62c5971fc9e434af8746030f452ce5576b853f590222b2abeb

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
9b9fc8d444a9d721a662362f6cf2a2a7

SHA1
749db590ed2fae15af7df570902172b71ab5fae3

SHA256
e3c1a8fe003ea2c7f3fca06ac87ec87abb71440a6180ac7d1a681b88091fc132

SHA512
b12f96c6daacbc8c57c1216cb72998a5c80a2b0b3c696b857451d56ce555dc0c43e838a3f46785229d2f6b6b80c59e6fec1dd87dfa7e9a035a6dfe550ef7fb88

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/Session Storage/000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/Session Storage/LOG

Filesize
137B

MD5
93416813e4e38efc97e2807ed0fccae1

SHA1
4c2d6f7dcebf44d5187c0bbaa21be8dc3f1cc96a

SHA256
30227a7d4e68e81dfaf596d38897bf1cb4ff967db42f975f0b8de76390c0f2ce

SHA512
08aefd1eac82bfaad89f0c8f41d35540c2533a386a3c59f3ab61dd733d46f000d24bf23b034e8f6efb006be0c73b676868b577acadfadd05a6fa18858f9fcfaa

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
c27cbffc323fb8fc265ac250d9567e6d

SHA1
64628f7d9d897f307bfa973ee9cb68943d5f9e2d

SHA256
2e553277e1c040fd3c1f2a1503bb958fc337320efe21f661b939fa3257d3469a

SHA512
4917f43858807972fcc37c2921279dbaaf3bb1d7235d82c2d02cab55b7e2aedfd44d75a13fd41dd1cb42ed8cf61502b6d02bcf2f41c8d11da40b05958d75047c

Download Submit
/data/user/0/com.zejabimebenofe.ledido/app_webview/webview_data.lock

Filesize
31B

MD5
bb53e0de7f383ce28ec9e4794eb4e8a3

SHA1
fa92ffc02dfe3cd181d690398be5692558759a48

SHA256
e59ffd9c1dfb351bb7d6e9b5f5e2553d0ba5c1bf1fe366448354156bc2574c58

SHA512
a49ca8037afa4c373d6bb89eab281c1a23b79d5bc1f5c23ad79b0722b292702fae7012ca97f913ecf3c4ee72134e226a081f2a6a28f644072ab73a6eb22f6056

Download Submit
/data/user/0/com.zejabimebenofe.ledido/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
9f3842fa28dac15a19fce20062f2070f

SHA1
43b48eb7e6a854f5bf854113884964f8bfa66491

SHA256
11e12ad2d66beab9317bc13b10216c2782fbe15e7ce5e45f1d759e9fbcd6009c

SHA512
c911108cee4acc5294c9116fe17a71fc3919a0cd375cf7560af22745b52197ea3099cb9ba4cc5d2959f6618bdf28209be5ad5e9729311ea63375afb30cc22a6f

Download Submit
/data/user/0/com.zejabimebenofe.ledido/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.zejabimebenofe.ledido/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
f8b9db58f3e73d533d3059f128b39f58

SHA1
4ac0119c5943da1771f0edf7d6319963cd4b29c0

SHA256
416303c846923fcfee52698dafeeb77201923875b12185da38a5c82bf0ba928c

SHA512
3c4fde4fa31db5f4e3549d8d225c9698db9dc6ebba63335255cb54698d0cc664bb56daeba67df6154ec17bcad4dd7fecafdc228d1daf3f760709f30f6c39666a

Download Submit
/data/user/0/com.zejabimebenofe.ledido/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.zejabimebenofe.ledido/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
4bfc3fc4fac8b4cd1a515e3f1f3d124b

SHA1
d27b360449cebbd870801ca58c7554eb8b5c32df

SHA256
a456b073cd6f43fd659d4ac84ed4acad454698cce4932e5ce1dd939522fb28b0

SHA512
80ba66de043b922cc6e3e95b8b412b2725558047055ab6bb2bf9aee838bcedc7fff325f742cc2d9ff085877b706119794b1d8a52963497250fbf4f9d8e64b0e4

Download Submit
/data/user/0/com.zejabimebenofe.ledido/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.zejabimebenofe.ledido/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.zejabimebenofe.ledido/shared_prefs/settings.xml

Filesize
138B

MD5
f648a03416ba9863e58d7cb2edb8965d

SHA1
2730779cd93ddf3c0c4d1891eb8bf6b7e38fbe36

SHA256
df045248c07cda5fd8db594566294c51596e0815f76ab25a9ceb0e787bfb0dc0

SHA512
d11ca62a27291453f1605f7837da3618973edf308e3445b1d69043e23373275f1c99b70b4b47d464aec9e637b940792cb2bc981ddae526681cf88834f105d649

Download Submit