ermac | 3abe643e901859b9148b124a1556ab531dfe1e37fa8413500b6caddd0382307f

Analysis

max time kernel
184091s
max time network
167s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
13-12-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ermac.apk
Size

2.7MB
MD5

35e91deffa2d5392c8d0afa3e83db6a9
SHA1

98b6acf59125ee3a37c0d4c3ab7cf6f295958f6e
SHA256

3abe643e901859b9148b124a1556ab531dfe1e37fa8413500b6caddd0382307f
SHA512

ea24dc840032159758708a2e43782bfbb6d56314ced043c2b75d43b32a7b486d47324242b85489354e809b858a04563e9c2557f76c69b3244b265e255dbd4ca8
SSDEEP

49152:d7MG0Evk+P+OP94fBhVmLnviujng53+mmaIHYymrvk8DwslHOBF:VM6kcRPQVQbjnUOak8UsEr

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.116:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4398-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ziroyotebufobi.rapugo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ziroyotebufobi.rapugo
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ziroyotebufobi.rapugo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.ziroyotebufobi.rapugo

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4398	com.ziroyotebufobi.rapugo

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ziroyotebufobi.rapugo

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json	4398	com.ziroyotebufobi.rapugo

Queries the unique device ID (IMEI, MEID, IMSI).
Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.ziroyotebufobi.rapugo

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ziroyotebufobi.rapugo

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ziroyotebufobi.rapugo

com.ziroyotebufobi.rapugo
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4398

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json

Filesize
456KB

MD5
fd10ed2cfb6e28f38dc83a900a6fccd3

SHA1
741b81cdb353640d98aea0284f3b0cbb402fae94

SHA256
7d8dc71608b0a8703dfd6b6f51ed4978969dbbceb5a522f41d87d543ca045e84

SHA512
47ec342f5479df00bdc0ba2caea5c932fcedff994e9a3f18cc23b3fa4bdbf4e14de11c43addc2ca6751e532e1776b83fef070740eeea72cb5de9184a9391f97b

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_DynamicOptDex/cjL.json

Filesize
899KB

MD5
1e5fc8acf0867c1623b1f6862729cb04

SHA1
c443349b4b9fe90d6c123a9975a89602563ebd18

SHA256
b5b523c1244ebfb5aa3531945479ac078e376e1f417b3f60ba5a502e54783d56

SHA512
278a06504944e86c896744e82c6fd22b3d1076c4f74c7d6ad543c797d62ffe11dd7bc78b53e08a003af65268f470bb93a7e8ff6220fec78f5638cb9c7bc6a0fa

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
9320c302e389c21e6bdaeea77d37453d

SHA1
5869182f471ca8ae79b7d4dc1f3b9a6f13c0e9af

SHA256
f586e245a1a633c9ec77dc8ed529ba242e61f9eb51349e1f6344f6ac0f9fcca4

SHA512
8931e59a822c0efab93102af3c93fc522b1cc60e7c534715ebf7cdb1946ab07ead650cc9e9075e332195b996a16e29eaa6f424d6ac932309cef6f105766ffffc

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/Session Storage/000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/Session Storage/LOG

Filesize
137B

MD5
970ba3935fd738a98c3ec1a2716b7376

SHA1
c330e4ba97915ed724faf00c4d46fab1be1d668a

SHA256
a13356e8be7706217796e7db5aa5078a35acb6da81c0e0b98eb932a1ae3e63a4

SHA512
e3f95008154a120e0c06a339234e2fbf13bd531d7c98c375c8fb1aef84d0919f87633b8c9bed7853ac454817730d68aa3c38157cd1b520cefd78fc420b6ede85

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
0f0b33defe24b2f7ef2f38c7621c46ad

SHA1
48187a72005882066f5ecbd568be44a7948af55e

SHA256
50de7538c1dd9f869ab239bdc10057c18d8d05d8827e9b79f2c3e292d5558375

SHA512
dac6cf2e8d3d04669425e082ae80538cd274bb379439f1b09024fa7d550f55e23efc2d3fc49583f638a5d924a29b67921c64dd39241003a707579b707a9a108b

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/app_webview/webview_data.lock

Filesize
31B

MD5
dd676cc243a1763482e0d2ba16c2f7c0

SHA1
ded097e19ed55e4042dd44751803ec59c1abc898

SHA256
0a911aece08dafb20fc47881d904977f396879aa710fcf8c9020ec1e4d7eaeeb

SHA512
40b8ff5a3c7f4d934c78edd3cc38bdbeb89a87c4349020007409de27bcdf83fdf515f473050a47d35b18ccb5d4484b694f75f85cdd5484db0bf9b2a824c26c4c

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
5dbf85e3856dd988ef51aaa6b8ca981b

SHA1
16e1e2bcb3a5357c2fd1524cc3427f5506f22b4e

SHA256
820c1a84823814771e0089a1918cfec23e74b57d0d0600cc1eeaa652d1096904

SHA512
1de71189aa004d10736927350ed2ff18a14ee25f88eb2f743ffe4108c379742f80de93fad02381cd8a48b359fca1caed596608418dacfd6990c1f26a80211043

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
8fd758e546f2255d003b89fe952b5d76

SHA1
2baf67875e9bb2344f06cf7c859aef964ddca7ad

SHA256
027156a6e55065becaeb3f6db5d58700ae28b726dd5a494a636505f83f15e9c8

SHA512
623305eb7975d7b494f55039c26d77ccbc04e5698059919556d67cc54b4d8ac50445e4a4ed9804f918fef6c1d7a14384d35a38fbd98253973b877c85cbe92939

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
3af1a3ef02bababbbbc2385f88d8fb10

SHA1
37018190aa8472958e79d593f42715ce44bdb4bf

SHA256
75459a251ed2401d4b330cc07d84142a0a88886a11aea7a5cbe95fcd91d110e9

SHA512
f12466638cdb4d1fcbf03796d494db12bbd1f21f803445b2c4cb70a564ba14a363597fee099f647fbf3b43432bdb3b81a63b87db59e08b603fb0dd7874f04ccc

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.ziroyotebufobi.rapugo/shared_prefs/settings.xml

Filesize
138B

MD5
8884259dfa9004e97b70f405bfc5bc16

SHA1
7765e4cf42a9f4bb43b9881635008850232001bf

SHA256
125d6146ba63444703bf5bef665ccd4a456a2630082ad8686ae35fb65f7fad03

SHA512
45f557c528de024aa45694ac0d65414a7329b77dc08453453fc0dd166d89eefb2666ccda9419b7d25280ab374f400bf379e5fa85242964a0fb86af7817214812

Download Submit