ermac | 33b7572766cef039979714d229ff2076cd5c979e22a11891ef6fc4baaac0e0fc

Analysis

max time kernel
3271172s
max time network
69s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
08-03-2023 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sakinacmaermacapk.apk
Size

2.9MB
MD5

59c1dfcf5cc3b76c961fe08f163dbb02
SHA1

12d002783acc1fe8573abf8f07e7fc79d2769f27
SHA256

33b7572766cef039979714d229ff2076cd5c979e22a11891ef6fc4baaac0e0fc
SHA512

38639d0029410c6af04c15e53a37d4c7e8e572cf8fae4c97ee347885615c30d65825d85f7c71149d6bc9bee8db5c12048695cf59b91f1e6241568d69384b0184
SSDEEP

49152:Fun4FKKpN0DAb3KBoNEzcnxmnHy99J9N1OG8Ps9KL4fED3AfnkIPBNLEO4ZT5Noq:FCelAAnxc49D/B5qD3AfBLn4ZTcyN

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://31.41.244.187:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4152-0.dex	family_ermac2
behavioral1/memory/4109-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zixudahitifo.gicu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zixudahitifo.gicu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zixudahitifo.gicu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.zixudahitifo.gicu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zixudahitifo.gicu

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json	4152	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/oat/x86/Hl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json	4109	com.zixudahitifo.gicu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.zixudahitifo.gicu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zixudahitifo.gicu

com.zixudahitifo.gicu
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4109
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/oat/x86/Hl.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json

Filesize
444KB

MD5
0bea6585938f017bcc65885ca587fbb0

SHA1
ca739eb958306424008b9980c18e7a07aef55391

SHA256
6fc4576bc81f3beda1a9e1b832886189f572ee444e0c5c9b4e450bf72fd50b7b

SHA512
7c8f576ff28090382b234be8b58d800c2f903c31d61c1a7c2366620d93c976c7050fcc7a65bc70032df6f56b4e2c086ce44b009f57a9686ea4ad9d09f42c45f5

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json

Filesize
911KB

MD5
2a7621a9ef6e7e4087b5e3d81d96538f

SHA1
1313742895ba84ecb5cfcf74709b31ecd6b729ab

SHA256
36dba42f29f9cb4284a67182928a5ac19087954fc750c2af6670cbecfa26c456

SHA512
3e5da188d2627a9f7140e7e5359314f0a442db6032f22daec6ec361479a361ad081123459731ffbcdcc7c9651646da0f7bf7b1230b81ec2bd645519f19e90589

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json

Filesize
911KB

MD5
e071d783d184c999ca79e2774e4147a7

SHA1
f4e37f05941ee25e02bc6781ba5ddc32d6eb9d7e

SHA256
123eb705335efa5af8a5b85f34e5a3afb45db0a406cf2cbbe15c9a202819d5d2

SHA512
e91e29888b9bf58835b458fb3cab0b300b9ca7c95a07282dfc7d7a75b6e67c07b26a2fd976b8d7d04b010881bf1537eff22ce7cde20c0abebc76550137b1f626

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Cookies-journal

Filesize
1KB

MD5
ef2d3b074fda4e35f2ef9941815337dd

SHA1
fb81060d5db851f274d1b44d87348aa1eb9109aa

SHA256
1ff2083270fa345f82b2f19c46a834ee67fe5214a26d009e8335bf464cccca92

SHA512
c639bbfecdd2ae348d63af455a846b8b4a0b4fd75dc0fb608fdcce8277e73f783dc59323bc3f5bc6ad8a2523c54d8825ecac542679fe9a1155a2427b1c47da7c

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
0a0bcf8a806dc2b4eae3eef63526f10e

SHA1
e45d72479b400b22c664dc6ecfd5fecc49e1a046

SHA256
e762e360612b92bf58cbd23cf85b1f3b29a5997b67d86e6ad3ba8b92c9ad7a83

SHA512
68f1ccea0d789e7a3158e2daf89f2db916bfb57226965e2e7b715cab17b99e35bac05087b62b157e0455de79449147a8fca3a2fa3defeb87c7e57ecc4258f7b1

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
e44edbda21fc6ea0e7256a72bf8a2114

SHA1
ee79f9a7d298221befe23865f226a909306f62db

SHA256
397b0cbd141377d7c67da8bc0890364635f8b30c2de0f06a7a674bdd375966a1

SHA512
3563e3a005bf118c2114990aa6b797e0bff2b23b5081196b3db29980eb99a120c983cc972e5dfe4f16f6380aea01362cc4a5aad108f98f7c6681fda69c432495

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Web Data-journal

Filesize
1KB

MD5
bba1ac7c41e424ece5aa0e2508b389a5

SHA1
8e12d579175a0ec60a59688be8d8c93b46d6971f

SHA256
cec723fabaecfc9c546d6eac007e84d964dbfef74d78490917e2b8853fa1ae87

SHA512
f77051ee3105245f36e70d9739b66b0550468ebb052632a00bc31d24a6a6f89e2e05e226123dd391420dbdb4268f5cd33a06c1d2ffb556ac3fdc9bb898e42621

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/metrics_guid

Filesize
36B

MD5
0cd8eda0178e445b68702e9b8a5951cb

SHA1
11991d1050a80f6c42461d722b047f28049b9c4e

SHA256
91e8dd6d3035b613ad747f0b64a509ced7edb403d9f452617cb94f4286c223d0

SHA512
b548e8d6ba78a90e1c4c16499eec31902b85baf6226cc2fc3b63f146bcd298832e920110bbfdd898dcddfb03f025ad34038a97e5312579dae73050d64d3098a5

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/a63f6ad0ba0d5e6b_0

Filesize
143B

MD5
b24f6cbbe4db6e310e0a58d49007f540

SHA1
209102a10f91258b1a2c55183ae2b575b4d63974

SHA256
e9ca5f4eb1004fb6f2b76054d6bce536ebf57e4e0893ef241952d13e909cac15

SHA512
340d2f15ce05e49233eff25c5858546610c162d3cc6fe9d519e868cdc4781d3bf24a9e0fc4ffa19afcfd4d8a56d643edddcad94b748d015019cd06db626ceabc

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/a63f6ad0ba0d5e6b_0

Filesize
30KB

MD5
299eb02aff6a3216942bc321286b9245

SHA1
087360a72b237d583a17720ebccbc1f60ee9de6c

SHA256
630c84b04073ff11deb25aa5a8d8033c2f7ab73270ebb0cf169393b22a776383

SHA512
ac9f438e5b56441d8f50f8db54c5665c614de62fbecd8f4c2ea42acbdd87a75d47c30204d524af9a3c76b36d4e5619f83e47d2fab385d37f3a807e7750c0a5ee

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
1db08fa209f4ae130bda97711ffd895f

SHA1
e0f1a4435b29172ac455a2bf933484deeab25ec6

SHA256
6613993124b62059125746f873fbaafed6dd6b9ea76ebccf4b540fe63f679b3a

SHA512
003a782e5a52fbcf36829a8ab9fb106e145ef4083b1fda744425dea461f47663b40eef39121b8471e8261c2f204d92a06be4da2bc919648d5955b7e56f05dc2b

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
2c7b04fc1987189b4b7598a5433f26ab

SHA1
5db793d81d2d104dd1102c2dc6c04362cdd8cbfc

SHA256
e28389b616172608d0462a25b278fd24fc8aa1d505cae4ccf46a39c0cf730ee1

SHA512
c72f1f651c40f62d98d7828d539ed804f17aef8af59678d81df47d66310f260de6269e4713bb89d6a1655b95146ad0509528d1d0b32725b6268cf052b9c2e446

Download Submit
/data/user/0/com.zixudahitifo.gicu/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.zixudahitifo.gicu/shared_prefs/settings.xml

Filesize
134B

MD5
f770197dee8ab5ace13f325d8f7999fd

SHA1
c199cc8f2bc121a6ddb8d2b61922ed4c3797995b

SHA256
a98f1264aab26b21d005fecbb0db2e746bd2b24ae04c3dbae162f6436206e3cc

SHA512
de3ab342f0b02ab96e97bfc25a73dd250f4d699517b78b5a89d62ea2c136598046173f4b49ca3060b05b077420e26682eb0f1bbd2d1855f06331cb9180920897

Download Submit