ermac | 16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a

Resubmissions

15/05/2023, 13:44

230515-q16n6sea6x 10

02/08/2022, 06:20

220802-g3t9gsbgh3 10

Analysis

max time kernel
531275s
max time network
171s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
15/05/2023, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoogleMaps.apk
Size

907KB
MD5

ea449f22d8dd8d8fe8732dd96d69cb99
SHA1

d0656d504fabddb0bccc284976120e1a8299dcde
SHA256

16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a
SHA512

0da0a54de3cc28d3d8f8e44748aa2359f048f4c21d319fb2941bd2b4866bb53abdd857b5f27a346daa5b7f79b9a68af89baff598133fb8fe0c1633a820328fe7
SSDEEP

24576:OlFD/teGNYj4ETDPHKDz82qBwWsmEg/WMsa:KzNYjVHqDSsmEg/WA

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3435

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4272	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Queries the unique device ID (IMEI, MEID, IMSI).
Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.ceveluriseze.xuca

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
e8a310eaf28ab022b4d502babe64e37c

SHA1
67ecceae6401550570eeb2c30b37e727caceef4d

SHA256
c6c7a6b4a53791d3fa82d0adccf3701907836e07ba5db67972090a996bf4da7e

SHA512
ce1d527a5e3c726222132286133ad4bbd369e15e3810a543819d90e6ed89c8d2610f259c94bc276a425dae52b3582466b448061be7fefb3ed8fa720eda467932

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/Session Storage/000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/Session Storage/LOG

Filesize
133B

MD5
64e2dd916f29b6a519d110ebccb5331d

SHA1
6b8b8c46df3c6b84e61db6d65cf893d098fe54b5

SHA256
06e887135bacb03d2b992cdcafc0f05984d4b8f18d970696f814a93bcfb4be69

SHA512
a6fc0c115e6fff02c158a1738e57991d37f6b7aca30365449bf0b82033eeb8be6cece920d5e24ab2964ce4004fcedac904487a7321625d20e1df7401c144d36d

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
66f8b12b2b46c6068aeebbc6744d4842

SHA1
6668e982b5c9a753c30792f375fc28e6d5630d4e

SHA256
ff2d58ae8e0b7d1c13ee13984e290457e0ae21a44986bf6ef3616911053af23f

SHA512
b6cf9ace52d5d37386f66f0645d93a389adbcaf125e099207a9cb914b03b6db10bc8cc4b2f329a13fda5af54bd80f638f39e107560a2bd79ac7b2d4e66cc9c7b

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/webview_data.lock

Filesize
27B

MD5
2a48faa8c021fea6c095ac809531d341

SHA1
9e1cdae547aa355fd2456e2d292417b69abc7142

SHA256
8a3411782f8198c7e1d6c756c5afd3378c7e5fc24e3505c82a92c1cffe4bf164

SHA512
7809f9bb6673d31e99829a57b3f028fafb40cb370f549bfef08c05e931b4ef5273cb247a8e9bf320d801a0b8258109a85a48701b998369275e6b64ec0a60b82a

Download Submit
/data/user/0/com.ceveluriseze.xuca/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
056bb8c0288f06857757a0ffc8a32c31

SHA1
6e63c00d724cce6ed9294527a9e2df03b33a8033

SHA256
64621cedcd514ef88ddb7a8c4e3ceddd86485032f76da39114d5fb3ca742edb1

SHA512
35b1ee31e1580166d832623206c6befdfa0fc99e05d32c1b14ab0bf572d7c73d60935b6e3fc8cd862314dab0326be352ebba1e0fffa7b7db7fc12cd9f7c608c8

Download Submit
/data/user/0/com.ceveluriseze.xuca/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.ceveluriseze.xuca/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
c4af7e7966a01a21bced82bfe43bc629

SHA1
b77a4667e198a77be7f8a39622ff13dc4115731b

SHA256
af0b5ef1c53e0e5768cf0cf8560f7afaef99d17c645b02ece69234470152b8ce

SHA512
77532e18ec8ec9834fb5fdcc7cd41c4226ab2021f720fe7c481fd5d09efc3a1a417f8cce3fd021235bcfb42c6008dfb424352fd66c10c29482306765a047a386

Download Submit
/data/user/0/com.ceveluriseze.xuca/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.ceveluriseze.xuca/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
4003bf098d66fcaa1fdd48d4c9329d2c

SHA1
838f427d04f289377c531df8c218b5dbfcad5f7f

SHA256
9eab7c313b5e3831207e1ceb7930c4e54ecf53a570f38ad35f619efb4618aec9

SHA512
2d0666b2060c200707d92b2fa0c9c7f480a338a9fb1153e67ecffdcfd37fba579d394499f81736fe1cf08f328c7d2bb69f024e2c85451c6c066406b9cac23161

Download Submit
/data/user/0/com.ceveluriseze.xuca/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.ceveluriseze.xuca/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.ceveluriseze.xuca/shared_prefs/settings.xml

Filesize
134B

MD5
097c71d7e1d6d23a16553dd66217f408

SHA1
0da820259c580853394a7ee20aa0e49c69f9d5c8

SHA256
aba8351b1c609018bb3b627889409b4e18914942118f39545fa2ab9dd7e86d52

SHA512
4c4b7ab1b390fda9c50b55518fee852d52d8d2a571e29e0f04e48c0b1e564310c27ba95d7273b45168b8a59aa6fa7f25afb93fe8f5661e57184092b08f56ba31

Download Submit