ermac | 3abe643e901859b9148b124a1556ab531dfe1e37fa8413500b6caddd0382307f

Analysis

max time kernel
180357s
max time network
32s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
13-12-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ermac.apk
Size

2.7MB
MD5

35e91deffa2d5392c8d0afa3e83db6a9
SHA1

98b6acf59125ee3a37c0d4c3ab7cf6f295958f6e
SHA256

3abe643e901859b9148b124a1556ab531dfe1e37fa8413500b6caddd0382307f
SHA512

ea24dc840032159758708a2e43782bfbb6d56314ced043c2b75d43b32a7b486d47324242b85489354e809b858a04563e9c2557f76c69b3244b265e255dbd4ca8
SSDEEP

49152:d7MG0Evk+P+OP94fBhVmLnviujng53+mmaIHYymrvk8DwslHOBF:VM6kcRPQVQbjnUOak8UsEr

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.116:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4136-0.dex	family_ermac2
behavioral1/memory/4093-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ziroyotebufobi.rapugo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ziroyotebufobi.rapugo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ziroyotebufobi.rapugo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ziroyotebufobi.rapugo

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json	4136	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/oat/x86/cjL.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json	4093	com.ziroyotebufobi.rapugo

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ziroyotebufobi.rapugo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ziroyotebufobi.rapugo

com.ziroyotebufobi.rapugo
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4093
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/oat/x86/cjL.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json

Filesize
456KB

MD5
fd10ed2cfb6e28f38dc83a900a6fccd3

SHA1
741b81cdb353640d98aea0284f3b0cbb402fae94

SHA256
7d8dc71608b0a8703dfd6b6f51ed4978969dbbceb5a522f41d87d543ca045e84

SHA512
47ec342f5479df00bdc0ba2caea5c932fcedff994e9a3f18cc23b3fa4bdbf4e14de11c43addc2ca6751e532e1776b83fef070740eeea72cb5de9184a9391f97b

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json

Filesize
899KB

MD5
9bc5bcbcc56bf3433028d13bda23fb54

SHA1
c9929c7485e5ecfdce50362ea1dffeac71a8b98d

SHA256
78bed3f8f16f09e284b4ffff2122975edb9397cc3dc8fa6c4e4228cc18220017

SHA512
8916d31f1f48167c5a59f737e63a185ff59694199265a246687fdf7e74535a681e3d1858a2acf4c941aaea64fb1cd1da590aa8f6474272627aa368878507c83f

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json

Filesize
899KB

MD5
1e5fc8acf0867c1623b1f6862729cb04

SHA1
c443349b4b9fe90d6c123a9975a89602563ebd18

SHA256
b5b523c1244ebfb5aa3531945479ac078e376e1f417b3f60ba5a502e54783d56

SHA512
278a06504944e86c896744e82c6fd22b3d1076c4f74c7d6ad543c797d62ffe11dd7bc78b53e08a003af65268f470bb93a7e8ff6220fec78f5638cb9c7bc6a0fa

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/shared_prefs/settings.xml

Filesize
138B

MD5
8884259dfa9004e97b70f405bfc5bc16

SHA1
7765e4cf42a9f4bb43b9881635008850232001bf

SHA256
125d6146ba63444703bf5bef665ccd4a456a2630082ad8686ae35fb65f7fad03

SHA512
45f557c528de024aa45694ac0d65414a7329b77dc08453453fc0dd166d89eefb2666ccda9419b7d25280ab374f400bf379e5fa85242964a0fb86af7817214812

Download Submit