ermac | 16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a

Resubmissions

15-05-2023 13:44

230515-q16n6sea6x 10

02-08-2022 06:20

220802-g3t9gsbgh3 10

Analysis

max time kernel
531262s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
15-05-2023 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoogleMaps.apk
Size

907KB
MD5

ea449f22d8dd8d8fe8732dd96d69cb99
SHA1

d0656d504fabddb0bccc284976120e1a8299dcde
SHA256

16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a
SHA512

0da0a54de3cc28d3d8f8e44748aa2359f048f4c21d319fb2941bd2b4866bb53abdd857b5f27a346daa5b7f79b9a68af89baff598133fb8fe0c1633a820328fe7
SSDEEP

24576:OlFD/teGNYj4ETDPHKDz82qBwWsmEg/WMsa:KzNYjVHqDSsmEg/WA

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3435

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ceveluriseze.xuca
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ceveluriseze.xuca

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4045	com.ceveluriseze.xuca

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ceveluriseze.xuca

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.ceveluriseze.xuca

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.ceveluriseze.xuca

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ceveluriseze.xuca

com.ceveluriseze.xuca
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4045

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.ceveluriseze.xuca/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
06ba687add9dd2cb17dbb06eb50467df

SHA1
813b6afcba4e940b276f833676c022067b8f613c

SHA256
06ba30f8fe325760b2585584a2d87e6f2d6ff9c92fafb2d87867c4bda101ac7e

SHA512
e0486388151f7152a5235a02370b0ec394761f1a0aa7bd71892f49cf6e913a167964645da5a9ef60611275083682bf0d5604fce6148ddf33b8437686c66b812b

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
69334a9638ec31a5b5b8091d4adaa003

SHA1
70617887c237fcb4ee6c8a5ada9dd748708f8f76

SHA256
985fd8208958e7865848ef92d332ca0fbdbcdfa8cc2166e3296248755359d7e4

SHA512
768a331df45d6877aad12edc40c8b289dd3d90994d5fcc051319df9354eede82ae2633c96a15e465441c7e1e09c0c28c2e9971abbbdbec08f03340fbc28329cb

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/Web Data-journal

Filesize
1KB

MD5
72ba8b0e85d8d7c86510e78c0350e0f9

SHA1
b64995a6e82fb1a9adb6b213d5ecf0b91ac6e013

SHA256
51a855b2a49b047a3bd5cbcab32c9a627e4427c08cdd22fba96045ee9e8b2f35

SHA512
3c1d97203f33a4e47885c00e73a35a141c619a6993e9ca73a366b69764d08e1e00af387a1ca137d0221ddd05e12cde28e21d7502aeaf38c5256204785ad8a094

Download Submit
/data/user/0/com.ceveluriseze.xuca/app_webview/metrics_guid

Filesize
36B

MD5
773416926b6c858e79e6c4408be6edc0

SHA1
89441bced5eef0c01b4cdfe9de527126efd13e1c

SHA256
47b87fd3b35edcb079a09f1ed074e8954ca72672a2c2e056faaf1e7b6061eeb2

SHA512
cf10a4d32e2ad2685376614574d7c2d2bcc4dcaf35e59e37b68432e5543faf63106fffeb28776df664981f1ae36f7636fabde2815f3a220da3579602428b9989

Download Submit
/data/user/0/com.ceveluriseze.xuca/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.ceveluriseze.xuca/shared_prefs/settings.xml

Filesize
134B

MD5
097c71d7e1d6d23a16553dd66217f408

SHA1
0da820259c580853394a7ee20aa0e49c69f9d5c8

SHA256
aba8351b1c609018bb3b627889409b4e18914942118f39545fa2ab9dd7e86d52

SHA512
4c4b7ab1b390fda9c50b55518fee852d52d8d2a571e29e0f04e48c0b1e564310c27ba95d7273b45168b8a59aa6fa7f25afb93fe8f5661e57184092b08f56ba31

Download Submit