ermac | a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1

General

Target

pithus_sample_a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1.apk
Size

2.7MB
MD5

035a2266813f3d204c64b7be514f913f
SHA1

09ce3654ff984682c917d1b37c28d245f771a6c0
SHA256

a48b1693a2f824848da0c258859e2c9081d6a8e11d7fb2e0d93a8aa2613037d1
SHA512

73a6016d7ddec0102f4621f05940dd3103264295fb45c5073ba9dfc2576e903f7dc3828fa21defc8174ea14e0397242afa4fd1812e137c1d19eb5f9a69ab5112
SSDEEP

49152:xWrpqJ2SIjTsnRQ96BVMZlf4fcrkDTCv5ZsOzrdtGiZjKNlNs:epqgS0q+g22C7zrLGSMlNs

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

C2

http://193.106.191.121:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4171-0.dex	family_ermac2
behavioral1/memory/4066-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.loloxitohuna.pitogoxa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.loloxitohuna.pitogoxa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.loloxitohuna.pitogoxa

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.loloxitohuna.pitogoxa

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json	4171	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/oat/x86/wlrjatm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json	4066	com.loloxitohuna.pitogoxa

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.loloxitohuna.pitogoxa

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.loloxitohuna.pitogoxa

com.loloxitohuna.pitogoxa
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4066
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/oat/x86/wlrjatm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4171

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json

Filesize
456KB

MD5
4c861f23b48c50285d3fe240a336950e

SHA1
527cf74f4f20ff2afd67b8a0ac04fa83b7bcb9c2

SHA256
6604888c866c79aeebc4a038dc7d5ebf652037d4de71659f96f84f2193dde5fa

SHA512
428f65798ce60ebcdc3bab385471cf7c0b2531ec52dfe21cf446808902580e4b477c4f75a404dbf8aa2bc5443683a5b8c0550322262c6c23fd0f89c64bc954fe

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json

Filesize
899KB

MD5
082fd060722191bdeef9592c7dba7c83

SHA1
967840f99c1920417a88bcf27f0831111b1aae50

SHA256
373b44f3435c3c1994299beba15c903518331760ec02abc8beb42951457460ee

SHA512
5987e106ada8244ea3f3bf0536d9ebb8c1e4a84faf75d973c4fb94b1a55739d980539d2e95aef0ceec0f099325c0ca7eb971823496e49338798d26c578e38b47

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/app_DynamicOptDex/wlrjatm.json

Filesize
899KB

MD5
2149d0e1c412d8a5e22b955a46ada4d0

SHA1
e9bf7faa4653613f261e1539373959b83c4346d1

SHA256
4c9091f9d6538bba4c53ce557b5ef35f47c86faad03fbb9b001232c70960a1ee

SHA512
3c8922374b44932ad16093b25688e650a2f255d2a351ce8db1e6ac9991df122b66ae414c5887322424cc6ddc8f5c676e775515313096611c9f60382a8f88809e

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/shared_prefs/settings.xml

Filesize
138B

MD5
c900c437e050a0a0975fea7d59ffe9a8

SHA1
43906d1111416d71b5b6c9ad13b3261c29497853

SHA256
b502542eb45bbc35c5518d6afe55aef84d95663cd0a781ed119c9d0f04356460

SHA512
4e4230f4b9382797d721a007091a04c1012f2e3542ca371633ca4d2432512210f1794ca5adec586032e728fdb0ebe511fba74ea7b94ea1c2c820564f67b1c595

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/shared_prefs/settings.xml

Filesize
180B

MD5
f36da381dbcac0767a81da9ac2339d13

SHA1
2c6a40503ece0a53a9cb165a8ff0868dc0bbbd2e

SHA256
9a648c48d03fbd342c51fa18d0ee7b2e8af58f2a3c7df398b7960b62573c3a22

SHA512
668fbac9e432466a4eeddcac1e7d503d9ff2223d3762292708e7fb6ed1901fbe3f46c1ebe38fb27c2e6a18550604c2a3ec83c5f659d36c58a810653b28be5511

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/shared_prefs/settings.xml

Filesize
268B

MD5
286df98202e6622f9380e5eda0f4b5d8

SHA1
1d09f4b3758dabf47b4e99b374830e54d8424b6a

SHA256
1a68669715d8a37ee74d86baf8f9b6233b571e917df188c849e9dbf64f0ca063

SHA512
6c56fc3dfd661119887685ef923569690edcda525d6ec3c2f24c656663e115b57ac655b5fc21bad0cdbd4e24dc28dd6c8febadd005c38f96d8b488d7564e59b8

Download Submit
/data/user/0/com.loloxitohuna.pitogoxa/shared_prefs/settings.xml

Filesize
312B

MD5
5775654f635ceff0c964b1628ac77e2a

SHA1
f201592108d7828e6bf2db3cd1a62d63f3354df4

SHA256
28d9034f56b64a563336b306c3c1f6a39e9e14a4a9db035e0b32d55ca552468a

SHA512
7cd8322294ae115996befa5c83d19be6090909e7c1010c83eb6b9de9a44bbaac0613cfa5dc285809904bc5efea33c94366bb712259a435862bdbf539585bcd65

Download Submit

Analysis

Sharing