ermac | e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b

Analysis

max time kernel
225561s
max time network
169s
platform
android_x64
resource
android-x64-arm64-20230621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
submitted
30-06-2023 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrome.apk
Size

944KB
MD5

a7b751b410822403adf979e12e011815
SHA1

927e3fe33a7105ffbdd9fa2fba6d260aaae71506
SHA256

e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b
SHA512

7bdeb598c701a7c0ecd608b34c7782d8bfdb2d85e290a838866fc412e0c22c4bf0de1daebc657de7b9c259777a0eefabc27c4016ebd0b111791ac04435df7bc0
SSDEEP

24576:9iAKWox06kfot/buzE00bl/uRWfqFOVcomxg/YSq:UAvox06kfA/b8l0bl/uRGqvomxg/S

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://176.113.115.150:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lexujemiyunu.wana

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4626	com.lexujemiyunu.wana

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lexujemiyunu.wana

Queries the unique device ID (IMEI, MEID, IMSI).
Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lexujemiyunu.wana

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.lexujemiyunu.wana

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lexujemiyunu.wana

com.lexujemiyunu.wana
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4626

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lexujemiyunu.wana/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
11314aafbbfc18044811929f41e7e913

SHA1
2cb011a04891eeb52206ddd57a5f4dd1b2a85098

SHA256
a94b3a9c4d401080077fb3f9d521f06a338864f240d5e3cf368d2841da3d79c2

SHA512
2c9f6a39c9b6c840116695602a3e3ccc645c70e68ecd46ef2f17f3b9fb9cee99def239aa505bd7e537ecc9d27f6c86f911e1d97768e1f6574001eef9615685fe

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/000003.log

Filesize
80B

MD5
69449520fd9c139c534e2970342c6bd8

SHA1
230fe369a09def748f8cc23ad70fd19ed8d1b885

SHA256
3f2e9648dfdb2ddb8e9d607e8802fef05afa447e17733dd3fd6d933e7ca49277

SHA512
ea34c39aea13b281a6067de20ad0cda84135e70c97db3cdd59e25e6536b19f7781e5fc0ca4a11c3618d43fc3bd3fbc120dd5c1c47821a248b8ad351f9f4e6367

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/LOG

Filesize
133B

MD5
fd9fa2eb8228a1afa4b273e56502cbce

SHA1
b23d2471da740033129783abcbcd3e092be1227c

SHA256
58eeb569d52b6061e924ecfb738c9c6b7f73bbc07a5ddffe8afae0e1f20b3a76

SHA512
0eb82aad23aa2998f4dbe62e93ab3f523c601b77e344204986244a655e724e932a39f68e94724903fdc3dc515749a3ea4715d14c27bcd7c44cb54b2d0476fe1f

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
924057740b32cf9e0d8034ba4d5ee2f8

SHA1
3a6c13cfa4b034b03dc74f9a0b1911b1b59ba214

SHA256
9e2e2d8226ab244c8d6ffcb8cdadc5fb25a86cbf3235f6954682c99ff4cffc4e

SHA512
84a2811a9bd1d3dd8d41129fc2c80703b95d563c5545070e2a3b872fb3ea1e940a8fd683204599c8fd7a0d0a8d5cbd91d87d172e6d1064e1b4995d85780290ac

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/webview_data.lock

Filesize
27B

MD5
e37d06e0c8a963080d90d0368ea085fe

SHA1
410f2263560b8fa753e4a99e226b64a80c1b02b5

SHA256
44156da35030540729abbcc140593f3edf4098863530a2d37211f9e4d11d85ad

SHA512
21a7bc404cf8926da9dda28bfbf17b7e2142d8d84370bc99d37830827ecbc88381e5c0aea3e111622a8d7b8c3ff0134353c18d258dfbc3bac41cec8e535a3c9a

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
4deb61b108641024e7aeecc78c83e145

SHA1
740b3756db37c9e9e89916b1076d6f93772a1013

SHA256
401219c0f7f2a7a524a9d7e5c18ae2f42af87d7c0dc7750df668941d6087b0bb

SHA512
063e98c0a365afa724a578973116dcad6b92c8514942fbf7a63fcae6be46a88686521ab75df46782ae8573ec52f8e7fb8365307bdeefb2f532ab6df7192de301

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
74c51447bc846708c6465638b646b2d9

SHA1
a83dea787d33e53736330c75b27e403a6157a8f1

SHA256
3477a0fecb95fa4e0fc8932aa22364d3b75bcb9c1e9772f96ba76b83ed7bfcf4

SHA512
99c4e176ec7ce0ee291009511b55aea855a006f5939807fb95d99cbce23bb42136ede63e7d5f3bad4b9bd8d9af66f11a50c8f3832164fc320a4a7885341cb0eb

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
15834d6c808f0c6a7ece00b052f268c8

SHA1
98569a800866e3630f304bb1b701b40871407f43

SHA256
cc4a6951e6d4d6ab0eb79e5ab07be79248d2ee7c52f6ec0b7e9a9a0fea206cb8

SHA512
de3f743f34123b82970997023f01ffd7ec56930d617eee9edf955ae4992ace73dc186ad0dd36169d114582e34e69b7b966e495b242b2f9647306fe485be10a2b

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/settings.xml

Filesize
134B

MD5
8db9484ded18dad5f1f7848c74ed51a0

SHA1
7a386acad96c901de974ee8d3e13653c2622b348

SHA256
a51a9cf9be177ae20da4ed5f725b299939e84c6d00a482093d3480242bbffdb1

SHA512
1b8c53125ffa1b498e6940e1d3cbcff1ce4ecc7f5114972bd1ef95881639daa17f0a1326c26d022d733a3e3c070c14b2d10379c2c0f0ab5b9289b753145d5158

Download Submit