ermac | 9b5905a253141d4f64394de73775541a7bb16714cff8d18684e24ae887c97fc2

Resubmissions

15-05-2023 08:47

230515-kp5d3sfe45 10

12-05-2023 04:56

230512-fkpqlsbg86 10

Analysis

max time kernel
513431s
max time network
131s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
15-05-2023 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617.apk
Size

3.7MB
MD5

a88a497b3ae6bb84209cac0906df61a7
SHA1

fd80903a98e187bc841a0aabe04528cc1654b8ee
SHA256

495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617
SHA512

684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a
SSDEEP

49152:4GXx4KE5XqsZKV0dw8zbn3A9/HKu84zXYenCh4ebzds31j/D0NcxZBD5I:cz5XqsZDnwxnXYenUP/dsOyxrD+

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

Blowfish_key

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac payload 2 IoCs

resource	yara_rule
behavioral3/memory/4132-0.dex	family_ermac
behavioral3/memory/4091-0.dex	family_ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tafupqzpqgmn.tmnhkq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tafupqzpqgmn.tmnhkq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tafupqzpqgmn.tmnhkq

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tafupqzpqgmn.tmnhkq

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi	4132	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/oat/x86/base.apk.clbwfis1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi	4091	com.tafupqzpqgmn.tmnhkq

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.tafupqzpqgmn.tmnhkq

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tafupqzpqgmn.tmnhkq

com.tafupqzpqgmn.tmnhkq
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4091
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/oat/x86/base.apk.clbwfis1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
e94d497c72c489d5cb2855b15dfc8de6

SHA1
3fc24b2b0cff384d737066a2a3b60600fbdc94f5

SHA256
5e1ea9c1972fdb5c645c7cbc42a75bde95c33d9ffef468c9bf12a28ebbb89b45

SHA512
9ab18c794b9587f43b27587951fd730301498cd1809e4a1d96b01d14c78a4db0a4e6c3a688aa7741e7e339d6aff07ffc7edc9c36b875d95fd9404085cbb96c6d

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
9097930d624c6a670cdfeecb38e129b8

SHA1
ee344cf21eff0454824f53d655219771b070acf3

SHA256
42cb3f07c54ab7081e2c8b546fa1b83f7b57d21552300bfc3dcb44c39580c661

SHA512
dd047790b8b7007b3117dbcaad3f4a563c53cfa539e8cfe000149b8825308e1083fe47fb685537ea263aa59f93683bcb9dff617cfb8dc949907d3dec2ff36186

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/Web Data-journal

Filesize
1KB

MD5
c793ad368d180c69e502d232837e2316

SHA1
712e3603cb02415e5ae10f0b984cfb45b5823f2f

SHA256
e836ff7bee79d6add07483afa3ec6ccfec86a340b5dca57104f3352f5845993d

SHA512
1330e9f64b11eb6703599c4acbed7f43f8aeaec7ce05c6027af3ddc36b1c1ee18a771ef044a57dbe5dad4ef0e0f2abdca53be80074ae37d6378e47cf2cb026b6

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/app_webview/metrics_guid

Filesize
36B

MD5
2df1e00f2f6db52fdcec78acbce247b0

SHA1
f6c86df887980cd11877e1690cd1cdb6f3909cff

SHA256
cf481a678e39c567ad65b01665be1aacfa4601e4d20bb89434a6df0679e7a2bb

SHA512
36723cd519d4a0efa5b2ff4b3ce6c044d82c89eed8e8c63aff74d6c6d921726b0038d38a17a2a2eb58b9b9ac4d2df15f0b7b4a45ca3e4574a6b24dd3062917b8

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi

Filesize
1006KB

MD5
785628ac297eefa20b94471cb186e07d

SHA1
bbef3134241a11db26e9f092df7aa6d49b188c6e

SHA256
43396139d94579d13c5401713829895198dace2e817d33ac3a5b2b7937930243

SHA512
cc3e63a211c76264a1873bf06c9282e35c2c68fee1a274f198f75f3f661d5189097454a18b790b7a982ab7e87d67fc1e9682b410a09d6e0876c467f9664ff0fb

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/qosbiyjhaq/faadweurhczgroa/base.apk.clbwfis1.ixi

Filesize
1006KB

MD5
c9fa87cda7b48167b61083339d8a8a5d

SHA1
5713569cada892f482f8f2357ceee3abf67238f3

SHA256
5f0679419f6c92fa94c310326fe2c88c3fea2725de9af43066bd487be8d35246

SHA512
96e9205c673f28a5e14395272aac2c676cc9cd1fd2454f6a13da69abf1a2f5af3035d4d1c0a24ab7a91762326f3ec96a2ec0aea43b5ca9e3f0ba7edf69c8e332

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/multidex.version.xml

Filesize
307B

MD5
c9c4ade9d212f9bfc4b7678a484a705a

SHA1
993f7da77091febd56753a0bfad446405b9d807d

SHA256
21e6daa7320b9de311bc5cd33f7fb00a19a9568a64d31183d1a5891229a5e280

SHA512
001e4e4d30e497ef0171111ffc61aa9e47d4ad866c6a39695b0c2fc288718033b6560f633e8d30854dbbf24921998344d7b3daf21122027444145dded9e7a46b

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/settings.xml

Filesize
3KB

MD5
190cbd41e824d133eb0890a3e35e9d26

SHA1
5e6cdafadeab6baae25438d54118c9608e129357

SHA256
91215f16b252f13afcdce60dbdf185c637c3e02633b2c35e4e68e44554d1e64e

SHA512
52da655af44c51efd78bdca07193dce8dcdd6dce08e5816bce42e1136a55e80fabd337d12b2aa09f8176b6ca1c4b2730ccf67f62da3f4c7edfd2d5ca4733492b

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/settings.xml

Filesize
116B

MD5
d238bcaede8d9fc88b09c0e7fa6248f3

SHA1
7dc3c46230aeff7499e958a777a15ba65d483933

SHA256
44b7e05984b2ff4a389f942dd8e2c6c948abb1edb92ad88d124472fb9ff974c1

SHA512
ef57d436fa7452f4d7a1e737351eed1a74155b8803ab28f838ae6cf134ca6b4be3a47731d024d2ba3c89bb26bdd24b68fb323f5b7d16c36712df42ac093a1a52

Download Submit
/data/user/0/com.tafupqzpqgmn.tmnhkq/shared_prefs/settings.xml

Filesize
3KB

MD5
b44c370a6e4cf3fdf53a43e1abf3f421

SHA1
fa5c458c80457fe8001606048d525784a57c6ffe

SHA256
db76fbcb3ed56396d7969a01e2b3743a70f522a4f68aa729ac77eb5a60243103

SHA512
06b584a367409387a28165a69b17154991701ec48a615f9e0f307e7aa7fefd4507a3d438382591b134597a98eddd62fa8ffe1fce4927d3d136eba0752462a52c

Download Submit