ermac | 0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a

General

Target

0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a.apk
Size

4.6MB
MD5

1c74d4eeebdbd04e6f9524f63b15b84d
SHA1

5d86aefe2e6632572b971338a5556ee8a9fc96c9
SHA256

0ec3aba023da64c28c3e664ba83a337782c855f3b39874cde59fe8f60b93573a
SHA512

866761e39296f3399a8b0af6209a644a1a54e0a5519130acf0fafc82e11ec36de83c7d4b7d38f4c4606dcae0a0c745d5f2896e8109d4d5c768ecdd04cd0c4852
SSDEEP

98304:k4HuqlDao42RLqaw/jTLq36t+FpyhRTcKm6eAdjTvQlye2tuT/gUMlgm:zHZ2oZ+tm4+fyTTc+JTvy0tK/L+gm

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

C2

http://194.26.29.28:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4192-0.dex	family_ermac2
behavioral1/memory/4138-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.qjlpfydjb.bpycogkzm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.qjlpfydjb.bpycogkzm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.qjlpfydjb.bpycogkzm

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.qjlpfydjb.bpycogkzm

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w	4192	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/oat/x86/base.apk.kI9Ugey1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w	4138	com.qjlpfydjb.bpycogkzm

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.qjlpfydjb.bpycogkzm

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qjlpfydjb.bpycogkzm

com.qjlpfydjb.bpycogkzm
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4138
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/oat/x86/base.apk.kI9Ugey1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w

Filesize
1.4MB

MD5
6d66718d6b092ebaf2e08f9571dacaaa

SHA1
ffec6bba6363ebfb65cb3dc21b992b3dc116c16c

SHA256
2b7a055d5d48d8059ecf309f91510af3873caa1c5d5dadbbef5d15ef1dc782c4

SHA512
f866daaee7ca1fa4edef60b4d4794579f1aa7fffd729294ec0ca64f4dac950c5ad786c7e425fedcd75401eecb5636060e7fe7c440342d4e947dff7f870d92dfc

Download Submit
/data/user/0/com.qjlpfydjb.bpycogkzm/egfU8goe8U/8yUk8fjykG87ekU/base.apk.kI9Ugey1.i8w

Filesize
1.4MB

MD5
b6743ab0c201878d1af5f0343ebe8fc6

SHA1
01300063b5906c950eff077f3ce980ecefa048e9

SHA256
36d11490991e9ec4ca3697e80b83ecca02d4457b71c5586531298766cf7ba8a3

SHA512
4f2801d8ca40def3013175fd08ad1a7cb6bd354397c3bcf0aeba01abb11d6189673c06f82e1808e7415ef55018120e31574e9e419baaca71f18e84e6db51a3c8

Download Submit
/data/user/0/com.qjlpfydjb.bpycogkzm/shared_prefs/multidex.version.xml

Filesize
306B

MD5
97c6d0b4ccd3e898d1141a179fe2a479

SHA1
b69525c8a5dc96e32f7424138a1369577922075a

SHA256
13548b8fc5295a0a5dc46b9a392a083343c41a2a291eea22f4ac72032dc844e6

SHA512
abb2961f4e13359669c98a7063cf0953db649ef165646db4baa6096db1589c04cea66d0927668bd0c46b8d342d5daa767f0e3ed05f18f64c4dee18d3a90667ed

Download Submit
/data/user/0/com.qjlpfydjb.bpycogkzm/shared_prefs/settings.xml

Filesize
136B

MD5
6cfa8b67e515d52630433d8c10ab2384

SHA1
c872b36e27c8898c3987cc06593d429ea078725f

SHA256
679a557dcf4e6a85f851d92a1f6e5f3c9244c1169ae24f99086da95c69b50cd9

SHA512
f46eb8374ba84246a226e96069967fc8dc035530b1b7ad192894fc82389dd572461ec85bf4f09d945422267b53bc9fa7d7f35cf99b604e6fe057e92339bba83b

Download Submit
/data/user/0/com.qjlpfydjb.bpycogkzm/shared_prefs/settings.xml

Filesize
191B

MD5
034192fa73a3203c2bce4d5e31ce191d

SHA1
1a6aa3e31812e74a15e112cdfb706def366d9ec7

SHA256
7844c83773d4f456b1a2cacc1efddb3091494021fecb1153fbb1143fe8102202

SHA512
3371e0c8b3bc7a0bd866e6b199f7b43f0af77c8573abb3cb767321c7da73a970c7bf52d636e616695687280cb53ca49c45c0bf4605f9ec5588ad2dad5d913c2e

Download Submit

Analysis

Sharing