ermac | 1746fe4d9b29130f3ad84b9d81b1d20619aba6da0835ede5c9c31f95f325125c

Analysis

max time kernel
1982283s
max time network
161s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
12-04-2023 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0399d5868f1c7ace8585daba2b93d794a19dd354f95a2c5ae0bc870237c9eb37.apk
Size

2.8MB
MD5

82adeeff58343441db34ff548c7c1e57
SHA1

c1c6555126e509f7797d9b3bd7b28e82c04c2de6
SHA256

0399d5868f1c7ace8585daba2b93d794a19dd354f95a2c5ae0bc870237c9eb37
SHA512

c3a2cff7ebfd7a0b43fe705fbeb1cee11cff43ab91c6320c7d5b6bab8d835d9c0d74e69dc552e4632a2e288b25b88663c0390d202ada762ada70c8c97bbd323e
SSDEEP

49152:0PDiW/t1GkT49g89ZvY85W3/9+BfHTA3s2NpgInk:0PDt/t1GQkY85PBfHTA3syKInk

Score

10^/10

ermac hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

ermac

http://91.215.85.37:3434

AES_key

Extracted

Family

hook

http://91.215.85.37:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4414-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pekinihiwirede.pozoweha
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pekinihiwirede.pozoweha
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pekinihiwirede.pozoweha

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.pekinihiwirede.pozoweha

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pekinihiwirede.pozoweha

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.pekinihiwirede.pozoweha/app_DynamicOptDex/drE.json	4414	com.pekinihiwirede.pozoweha

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.pekinihiwirede.pozoweha

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pekinihiwirede.pozoweha

com.pekinihiwirede.pozoweha
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4414

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.pekinihiwirede.pozoweha/app_DynamicOptDex/drE.json

Filesize
677KB

MD5
df2b74b7d83a28e229bc5612c38d289f

SHA1
7433921101550b7ccb5662aeabb40379faa51cf3

SHA256
3835d1c64ccc96e2fb1edb76ec5971f65477b287f4c87b59ae541d0c6a5b2596

SHA512
707cc855dc8e6d48a71cf9033b5c944e132cd9025cdb138a93c3d00f2f29208f3d4946e5aba0701aeb6fd8027df38a5afb50347e1cd856f2fbe6cb21d6838604

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_DynamicOptDex/drE.json

Filesize
1.5MB

MD5
45396ffca23f6f1a7af276e2a16a3246

SHA1
ee494c58fffc2870a9099fc82d7b331441c4adfb

SHA256
04a8baec0ed8192ef613b6162c1cc1b2908b4e066061fc0d28e4e8edeb51e011

SHA512
fd9328751bd6937cb99c45861ee0080d134c8abf39947dea338f479fecf976f99d1a396e79f42de82b107c1191bb6439f22b80a38ad3fa7858b22eb9caedf92c

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
4f4ec7d6ff047dd021d065a86c81e40c

SHA1
fcf715c49823fa11be6858b447c9cb572c36141c

SHA256
ebb043d94bebacada94249fedea1f2ce343528b32eef6085ac4560736d21cecf

SHA512
712351765cc24f0ec79ae647999630d65f30e1b9d092233aec03b98f802405af8f53cc681b658fd59d768c6a5293f7ff2b071af01d1ca978b4a3e589e2a8ee7b

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/Session Storage/LOG

Filesize
139B

MD5
bb2910892530cc65004a072bacf5217a

SHA1
327319c51d088891a21e9ec4c9f98a2db16d6457

SHA256
1520daef1a2d788a8e52c4d64bbd0d787a6454395aa1b69c851b50db1379e11f

SHA512
419bbffaca2aacf11c3fdce5a20186747c11dffa052ff39190dde908134f5a77c2bc8d186670cfde22e449a4976a920a3251af95d484ef005257b9d4074cf670

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
92488586b922fe9dcbeba6b8be7f172a

SHA1
bab4a6f0ab92572d6fa807aa9400d0c8debd8127

SHA256
38475b6495ffe0ac87ee2563c4c549cd17d0334c78f8696fcdf45113097bc502

SHA512
903f23ae3aca839b3fe4349563c5a5769d9b03453a02295209bf951bd71d2e6eb8fc7710a99c888af8deaaa467b515481ca60203338b90abadd991f1ca2a4067

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/app_webview/webview_data.lock

Filesize
33B

MD5
0b2a3298865a94622a5d052a307ccdf5

SHA1
cc86ab6f60979419ed1ff92365d3fe2e5e90e80c

SHA256
edc490bac1785787c642d23932bc0a22069d2c93d410afcdef26405419e0cf1d

SHA512
c9d801f8cdb608be9e00c673053c73e589b5487f2d1e989adefb5e168f8cfc90beb235422ae73cf8d5ab87e10c133f1c5a2039d3c8980b4d1473853b3fa190ee

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
7b2ae651ddb4ec7e902a438ddb847b6a

SHA1
20a3e326ad8e261de6c019e94f0d3f50e87a75d9

SHA256
a71a192640cd562b8ed1e99c4e4995c50a899768361f93dac5e394bc5706d7be

SHA512
e607fb682e5f367cdb13dc916a5f3e20f0fd62b0824212301db0e90e9c19185ba700bf803217fbd8b4b18dc11153dbae412dc0e8705c3e45e13342bba84ec70d

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
7809c2e30ccd991c3c481861caf3f7b3

SHA1
165fe9d7b6adc4092d66c28e9072e75fd5cf6656

SHA256
4e529b1a319a38614d065634a182f2dd0d960b7986d361b5e5fcd6e99c87c28e

SHA512
8d6039d855ba4392796f0ebc8f221d142e8aeb957862dc2014ce7d7f7615bbb188c9122a6cc84b343eeca553886406c853ea353d17b96e65431134a06837e2d0

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
d951575b3436576a8fea1c4e043fa194

SHA1
4084b7cbad8681f4eaacd4ff786d423bd5e1366e

SHA256
05e52791fa0baa9eb15ddc9fa0636612e43742ee351b7e9e395ece6885dd0582

SHA512
9328065b64f719126880ac8fc539746e39476e049e3042f67e13e1dc7ac1c613ab7c9c2475a29f3e6e50b13b385ec468c273b6e681d3091f228c3256ea4b950d

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/no_backup/androidx.work.workdb

Filesize
8KB

MD5
e579a6b00eef1318f9166352228eba18

SHA1
76988896854f0139083e77862eea1a4846cf039f

SHA256
4b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935

SHA512
c47632e957d87727bf6504a82ca7a44d8da24d30cd997a0f449a96e4f97c656a1b4d9da3fcd827e2a48c59677688da0b872358ebd0f9369d898d1b8ec18d5699

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/no_backup/androidx.work.workdb-journal

Filesize
1KB

MD5
fe027a2cc845f62af7ba2b8b02728554

SHA1
1f6e3b2597b4d54a082c948927e461371edd5a30

SHA256
b8f4dbce9680f9e8e93a0b393ffeeb306db325a49456129d6af4cc4ea0cfa57f

SHA512
abf6a783a6a315e2e51000fd0f63f9e64fd9feeac1ec1a91dd44cfd1923d79098a7bff8bd1b964002cef35a961e7e6dad20ccc337ae2d1da0d223e377ef37c84

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/no_backup/androidx.work.workdb-shm

Filesize
16B

MD5
4ae71336e44bf9bf79d2752e234818a5

SHA1
e129f27c5103bc5cc44bcdf0a15e160d445066ff

SHA256
374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb

SHA512
0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/no_backup/androidx.work.workdb-wal

Filesize
346KB

MD5
ba423677cfce7d55c07428aceb22efa3

SHA1
2dd1994096b9601fca5ab5e92788356776dfb2e8

SHA256
332cc2f7b3019c7b4a11d5150e945d65936406b3955550b4b5660c9464c86ce6

SHA512
39909da774fd4e47a7ee149a55f75620555f91b68829b757161173e51e9abf3db64b931c52e571525a17538f0c04c219cd7de24485ed172525a31a1b042c5c28

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.pekinihiwirede.pozoweha/shared_prefs/settings.xml

Filesize
140B

MD5
4d9f55af4113326d6fcb383640a05ff1

SHA1
d468f8d4df5927ff477149c9eeab2af4daea621d

SHA256
39d09e93931dd6e25682418abd625910eef9bbe5d2fe18a8d0454ad62a5b7eca

SHA512
6526af892bf14b97bfc2499b9d90868e1403d3c8f55c5c9e25309063b086b553a3ecc25357d711923590dd4aff9354bf939387f17c674b2f5073c1f469491f60

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads