ermac | 9b5905a253141d4f64394de73775541a7bb16714cff8d18684e24ae887c97fc2

Resubmissions

15-05-2023 08:47

230515-kp5d3sfe45 10

12-05-2023 04:56

230512-fkpqlsbg86 10

Analysis

max time kernel
240342s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
12-05-2023 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617.apk
Size

3.7MB
MD5

a88a497b3ae6bb84209cac0906df61a7
SHA1

fd80903a98e187bc841a0aabe04528cc1654b8ee
SHA256

495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617
SHA512

684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a
SSDEEP

49152:4GXx4KE5XqsZKV0dw8zbn3A9/HKu84zXYenCh4ebzds31j/D0NcxZBD5I:cz5XqsZDnwxnXYenUP/dsOyxrD+

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

Blowfish_key

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac payload 2 IoCs

resource	yara_rule
behavioral1/memory/4162-0.dex	family_ermac
behavioral1/memory/4119-0.dex	family_ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tafupqzpqgmn.tmnhkq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tafupqzpqgmn.tmnhkq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tafupqzpqgmn.tmnhkq

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tafupqzpqgmn.tmnhkq

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi	4162	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/oat/x86/base.apk.clbwfis1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi	4119	com.tafupqzpqgmn.tmnhkq

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.tafupqzpqgmn.tmnhkq

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tafupqzpqgmn.tmnhkq

com.tafupqzpqgmn.tmnhkq
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4119
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/oat/x86/base.apk.clbwfis1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4162

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f3674a5a3ee661608dfab229b737182a

SHA1
152b9938eca1c3eb507a98a18c6d4c7930bb5da7

SHA256
9cf553689da9c5c3077707baf5e8c1d83a0d3dcb9959b0f970da128fe065b616

SHA512
3aa42bb13c31be785c2a9af7b6f63052a900227c963047d5d186fe9daa280e6e89efdeae04ee242a86648a20afc798bd648136dc7564f89e10620a56116d6308

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
5fca1f66f09747f142f4a2aebca899ac

SHA1
4d72f22f2b3b1883f93c5646977b35cc8d449927

SHA256
3ece248276e2668055587820c07d1f9302589f8960fc78766a339a12174b50d7

SHA512
8cd90ac42e807b5c63d80c9249ba193308811ad9f19365aa667b8c95a051701a4db87297e7ed40cddc44907d8dbdbe19cb309982345f422b254ea2008bda4381

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/Web Data-journal

Filesize
1KB

MD5
44675a77bdfbe2a26a2109665a9f93c0

SHA1
3c94c4c9ad48cc02174cc6bf633954574eafd482

SHA256
e72a832d45174239a0bc39d3cd0f8022ba8e0037a701cb4cffc4b47bf8a7d198

SHA512
64e9f9232c6c5d98a152957162cd8314556c01d752abdd4c65a47b316bbb5bffd30513e76e69f12ed730212bb6de71cdb864f85a9dcd4f7e079739815e94d7bf

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/metrics_guid

Filesize
36B

MD5
6979aad68928eb7aca4820073a77a074

SHA1
02e9f19a42312344645e2920c1d19b147a06f57e

SHA256
89f872eda4b3a939c7c11e278f6e7ac2be8f3df3c4a4b12e9206c5c33b908c8a

SHA512
00a763258433dc43495e6109982475e79b7de9b6fa7b01543740555cc3ce08921070113f5f3a41b4eb53d182637c5ed35ec8cd58794c052dd7af6f269cbed471

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi

Filesize
1006KB

MD5
785628ac297eefa20b94471cb186e07d

SHA1
bbef3134241a11db26e9f092df7aa6d49b188c6e

SHA256
43396139d94579d13c5401713829895198dace2e817d33ac3a5b2b7937930243

SHA512
cc3e63a211c76264a1873bf06c9282e35c2c68fee1a274f198f75f3f661d5189097454a18b790b7a982ab7e87d67fc1e9682b410a09d6e0876c467f9664ff0fb

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi

Filesize
1006KB

MD5
c9fa87cda7b48167b61083339d8a8a5d

SHA1
5713569cada892f482f8f2357ceee3abf67238f3

SHA256
5f0679419f6c92fa94c310326fe2c88c3fea2725de9af43066bd487be8d35246

SHA512
96e9205c673f28a5e14395272aac2c676cc9cd1fd2454f6a13da69abf1a2f5af3035d4d1c0a24ab7a91762326f3ec96a2ec0aea43b5ca9e3f0ba7edf69c8e332

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/multidex.version.xml

Filesize
307B

MD5
fe96762fe976cb5cbe6440b8877c91b2

SHA1
04f2b2b033c6b42e3bb7e1a8d441a6ac506e0073

SHA256
8de891b0c1d55bc1d85f6a48c576dd4f31bfc1e3a8d59894cfd83e6d23016736

SHA512
7efed5161cc8fe0238a3cabcc90d377359f89b9962ce73c8bb127914e485f7fe5e111036f5a12cc0f6d84ee9d2b614feadc050c22bb0f73deb9463cd53db967b

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/settings.xml

Filesize
3KB

MD5
b924f0c5ebf1a82316cd791f4193842e

SHA1
438e6c92ce7bb070dd1c155063dc0cd8a28f6172

SHA256
f0b8f24a5073edf86d3df61b6ac2f1b9db2c5dfb9a43467e430f9d722297e084

SHA512
f85d4e3e2c3004e2cc450b936b2547d3157b62ebffe99ecc68e70d8fceb4f347170a2995783c186574118d3727d93c526df42af1c66ad4c2b1bdf269393983da

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/settings.xml

Filesize
116B

MD5
d238bcaede8d9fc88b09c0e7fa6248f3

SHA1
7dc3c46230aeff7499e958a777a15ba65d483933

SHA256
44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1

SHA512
ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/settings.xml

Filesize
3KB

MD5
ad4d26dac07d9ab28400348595151997

SHA1
fe5671e9bf37e5f175bfbf048c28ccd9107ead43

SHA256
f8995f6799421eb5a4614d69d3f2b86cf332d8cb522f7a4fa4748d4c5a4335dd

SHA512
b92a15b81d79b23b7d5df91f5d58db63b311f7d6649ae538a1af4cec04d603083af9ad7b5e45339cc802066090636e9c892592f4b0c4b64b42451c5355a1b62b

Download Submit