ermac | 4ccf02c87de6c0bf718d9f8cdf6c61a9edc909fab1cdd7d497572e30fea1f580

Analysis

max time kernel
182341s
max time network
156s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
13/12/2022, 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ermac.apk
Size

2.8MB
MD5

72b3faff0779e1ddaef3a317fbefa29c
SHA1

6af79ef669a9250ae2599348f103f772817c88a2
SHA256

4ccf02c87de6c0bf718d9f8cdf6c61a9edc909fab1cdd7d497572e30fea1f580
SHA512

6a288603b55685d7ce6573ed632f3497f339e7e71e405c9d1fb8dee11a58731bcbbcc137ac3320ee4e88055ee285a5a870f3ebc8258f101bcd83de19ce9543d6
SSDEEP

49152:O7MG0EqP3bAU5vB4f/VBiEZEuAI12iQ24Xnviujng53+mmaIHYu6O+c9:+MHP3bvBmBZZEfIAiQ2ebjnUOZ+g

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.116:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4124-0.dex	family_ermac2
behavioral1/memory/4090-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.heruhifosexowe.piwi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.heruhifosexowe.piwi
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.heruhifosexowe.piwi

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.heruhifosexowe.piwi

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.heruhifosexowe.piwi

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json	4124	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/oat/x86/wZTAb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json	4090	com.heruhifosexowe.piwi

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.heruhifosexowe.piwi

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.heruhifosexowe.piwi

com.heruhifosexowe.piwi
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4090
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/oat/x86/wZTAb.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json

Filesize
456KB

MD5
745780b4c7bd7ffb3e12e203f8cada52

SHA1
4615d1372289c0468d2c86e07bbe7e914b45d68b

SHA256
56ae1eaab2a1c9e135d908490c2c2f8c2ad11073bd433bef70c25729bfec7b07

SHA512
e60a8769b2782a62acf6cb114778af9b5a21a119c11e8323b5556b6b2834d65690a98e0ebb35f6b9890310168a06104606688f17b5297fe149477cc6efc43903

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json

Filesize
899KB

MD5
2154c0200a1b41af07ed73e975e26a55

SHA1
39e0f57e32dcd35b565950fffb090abe18a82a2a

SHA256
b5c6a065735badcf3ce3a8a9aa1508d7a1164eb31474ae32110c4ad0d89dc4c9

SHA512
4d831227e88a2ef9f7540a67769a1cd9a638625c947f2ccb20736cfede5f5a43df5b3e061ae3c55090f6ae96525395256cdda7dbdd9656320f278a63e820d620

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_DynamicOptDex/wZTAb.json

Filesize
899KB

MD5
4705b243f88e10b75353e79019cc3c3c

SHA1
d4560eafa95c42228f29f049202a4ce1a1225f99

SHA256
875e2d19b70c266d04fff7b9c47947af697aeea1d115f14bc0d79b54d4034026

SHA512
a568e2aa5457a58d97a8720c3a15c5fe7176a7f3e6d16435041bf48733209012882a60d782dfb42a7f92dcb9b4e818f601acbca08d9cc3a76089ad3df331a36b

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
9ead01275c033cf1048abd1b6eed3164

SHA1
15e37b2682c7cf0d448bc5b4dc43563a07d23d0b

SHA256
be23ef2f777fdd15a0b8e1ff1563daef846a84cc99c91b042784bd5758611153

SHA512
ac1440a8cac49efceb892e9c1fb23889ae143a6d08db29e863aaee077ff02f24499d7c3512f6d9b56f268efa21766477ca59151d973014e15a2524f92c4ac892

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
567d7d496afdae214ae5bc64c5fdcead

SHA1
102da9fd5a41f5dd0597bbcb6a14e630d32f6a5a

SHA256
0db03da1d1c313439bc9ee73f618238f780afd16d720b202e773210d21e8f671

SHA512
9c50720b643b3026ed0db99f40ebdfe84ad0c270c0c07abb6021dee54a6d41eb217d4ee59cb00c68b169288fa002adf9822f4a7731c8a46662dd6d286aea2f64

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_webview/Web Data-journal

Filesize
1KB

MD5
248de0b50efc05531de8d48da85b4fea

SHA1
4f5882f2793e944e0440e5f6092f0e9e068f1e47

SHA256
3a8fdea9c21dc32e917b9c4863b1f14621b02e67c927236508f26eecf669bc17

SHA512
42df41fea652714301eb68342c6d687d24e451369be7bdaf600eaae73910fd8c3661c0b0a2ed446361b0416abe2664df97ea94a52edae60da358752909af7295

Download Submit
/data/user/0/com.heruhifosexowe.piwi/app_webview/metrics_guid

Filesize
36B

MD5
8a12fcd2c4de9b2f2e95ce1896d85053

SHA1
ca0529b503b777a49d2e1eecf9af1e1921fd6586

SHA256
8d0c254eac40639c2e035f2f8c368124557482f1588e36cbfa224cdf87c78d06

SHA512
15c8feb6530279a95f7d611ebc2f4edb0f8ba7396c46bdbe3ef3eb0399a3e3d2e6ce291d0eaba9d9d07a6be7aeb52a4893ac284825963790cbff009bf8cc6dc6

Download Submit
/data/user/0/com.heruhifosexowe.piwi/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.heruhifosexowe.piwi/shared_prefs/settings.xml

Filesize
136B

MD5
60e1ee6ad1a7dbb842885ad8f990644f

SHA1
2325663b3dfcfa9bf5189c3f0ad26be2f59d6fb0

SHA256
ac9f2c97c17ab6dc65aa153b726f28981369fc278c115697629b7b2bde10d870

SHA512
f38e54e2dd62c315d0f0840c9cba11de19ef17bea834b5d0fa1a76aef63f9e4c7466f4e8df95db6cc685b759e581f1844ebbbd753b56717a5b82975f50ee793c

Download Submit