ermac | 25480135b73b5a471b66fdbcc10a154df26ffd58f7aaf8c71b1156f85e987eca

Resubmissions

15-05-2023 13:49

230515-q4rdnaea8w 10

02-08-2022 06:20

220802-g3y8fadahq 10

Analysis

max time kernel
531533s
max time network
131s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
15-05-2023 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecureChat.apk
Size

2.4MB
MD5

7b5208630df41b5d3cb968cc1bea9a0e
SHA1

fc5d84f4b5d9b65732fbcebc255c962ead9dc85e
SHA256

25480135b73b5a471b66fdbcc10a154df26ffd58f7aaf8c71b1156f85e987eca
SHA512

ac35592b7a816c15e2ce4de6008b42bc33a0663051257f2c13d79d420f57495b44a65fc8575a8faa51396e6a5f0180fca3e4c7e2060b8f965a5e3fec53d13966
SSDEEP

49152:djiu7DzF+G3r/xoY6duVSGg++tHlwRUAj4fxofgwasHB6MknM:siF+Gb/xR6duw+GCIwrBN

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://193.106.191.121:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral3/memory/4061-0.dex	family_ermac2
behavioral3/memory/4032-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hecawoyokiyusati.xemiki
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hecawoyokiyusati.xemiki
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hecawoyokiyusati.xemiki

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hecawoyokiyusati.xemiki

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json	4061	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/oat/x86/CmxhSE.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json	4032	com.hecawoyokiyusati.xemiki

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.hecawoyokiyusati.xemiki

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hecawoyokiyusati.xemiki

com.hecawoyokiyusati.xemiki
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4032
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/oat/x86/CmxhSE.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4061

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json

Filesize
455KB

MD5
8741150f5e1564dd9d7e76f6ec9f7fb6

SHA1
cfe513b6c6945d49af22a6e4ccab5c8e9889e17e

SHA256
a18a72c69bfa8e5689f47bc340e9e45c8762293bd07dda4fe223f6dadcb6a08e

SHA512
cbfd577c24eb2ba6ec45f9acfdcae5e9b29dc8eee42de9fbd586c26c2b6bf98881f0975863706d8a581ab1a21ccfbf8bcc756d846d1547fb4f146e6d7d9adb85

Download Submit
/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json

Filesize
898KB

MD5
27232bf16f21f9a7f55b8e2b2e01bd2d

SHA1
d2f0d9abf6b6bd05e4185aa9f23d9a8461a76e5e

SHA256
ac977fe8e0234d50bc5cf3775e9bd769ce43feeca784438d9d2437e6f7ef5b1f

SHA512
1ce3d78786ee2ceca2fa50d7aeacec9fb529b0996e5660247d18764bcc74d369aa4d9790d8156f182f34f7d6f5fbed46a5d75a11cf7a5214a71a662ecf538787

Download Submit
/data/user/0/com.hecawoyokiyusati.xemiki/app_DynamicOptDex/CmxhSE.json

Filesize
898KB

MD5
8c2cd7b9abb46f623d8f979aa3b70a38

SHA1
50c2246f8000817f33229ffdf41abc971951ba49

SHA256
6e1fe61ad44b33fa6c134cf1af78a387f0dea07f3109ca6473777ee2f7bc6c11

SHA512
80dff700d823ac16e5617d01cade4464d49500d6802459629aaac05624c230401a0198e8c3aef89c75f488551b284715aaab241d738b8ba0062c86a40aaf2096

Download Submit
/data/user/0/com.hecawoyokiyusati.xemiki/shared_prefs/settings.xml

Filesize
140B

MD5
9eccee7cf8fb5cbd10b060a89aac2978

SHA1
d681e18bebf91801e7db1cafff328a4ada67077e

SHA256
2598b90720139584a50648051b16717b9ceb2d8293de271c2f0e6a591656c520

SHA512
be9558810af5c7909f34874f1491dabfd32adc2cb258be87150f3ef46ab487eeafb88d8e3aa9a741079f1e5f4c61216f1dfa52fe6b6dddb522ccd41d44bc7f46

Download Submit
/data/user/0/com.hecawoyokiyusati.xemiki/shared_prefs/settings.xml

Filesize
184B

MD5
e9d68131c2d356fc42e68f18fb9535d9

SHA1
ce6c6156dd71709bdba43daf9549781b44d786cd

SHA256
2b0440c056fbd5ee4925063ca3c3c6655059f978bc9469c4fed7706cf1e7cc37

SHA512
dfd1f848174766d94caf9857cabbc20e389ebed63dbefdf297047064531405acbddadbe47c8bcd690f0e9bbf3e7cefb34b984b792680f002967746826adaef9b

Download Submit