ermac | e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b

Analysis

max time kernel
225550s
max time network
156s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
30/06/2023, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Chrome.apk
Size

944KB
MD5

a7b751b410822403adf979e12e011815
SHA1

927e3fe33a7105ffbdd9fa2fba6d260aaae71506
SHA256

e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b
SHA512

7bdeb598c701a7c0ecd608b34c7782d8bfdb2d85e290a838866fc412e0c22c4bf0de1daebc657de7b9c259777a0eefabc27c4016ebd0b111791ac04435df7bc0
SSDEEP

24576:9iAKWox06kfot/buzE00bl/uRWfqFOVcomxg/YSq:UAvox06kfA/b8l0bl/uRGqvomxg/S

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://176.113.115.150:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lexujemiyunu.wana

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4019	com.lexujemiyunu.wana

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lexujemiyunu.wana

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lexujemiyunu.wana

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.lexujemiyunu.wana

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lexujemiyunu.wana

com.lexujemiyunu.wana
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4019

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lexujemiyunu.wana/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
098fad2ce05bc17a842379bfb228925d

SHA1
bdad0fa5a1490a25192ab4b29c587a5bdbfbef8a

SHA256
0c08fee39e1160c0d9563941e64312dd446d0024273b46c6ef649845dcfc2311

SHA512
ede9c88929be6d3dc5530d5d9319642d0591b393eeb535bc8a2b90533685e67bd49a3924b4017b0ec8477a58fd65a8c8afd69cd7c0e2a6fd1b6450e298df106e

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
e26a420709e240bd9781c817670b9c03

SHA1
e0b58abea845da5a9f8a63dcc22043a5a42a7a87

SHA256
a3b1ef81543bbbd953f6b8f53cd1297bf885793e42f42e3221ef3c01ccb82bcd

SHA512
9780b483e83982f4a9a0c3089cb420ebca623081ff94ee99879f1f414d2e5c6de0932e3d6972c834ce30d5596b6797aab9617ed8f81f5b94f51bb37ea3ca1ac3

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Web Data-journal

Filesize
1KB

MD5
5646fe746958f63d1a9db01543a156f6

SHA1
ed6d67400f1323f609dcbd9bc7be2a0725b1ec10

SHA256
67a699c42088f7877c0f25e01fa1364925d3548aed52803d47d2b9aa21ae43f9

SHA512
d4f9dc374dc9837c0ba15f6f5bc6d3fba1ac27fa802c4b2bcd96de243bf12324d2f6bb4f9e9e1fdad4508ab997a31793b30307931aa6ac77b3a56ac3914e2bbb

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/metrics_guid

Filesize
36B

MD5
135b33ce313e8b8f048f71f138151d17

SHA1
d8809a6fb2c5995930e8f2ae41bf0f9239cfda16

SHA256
9bf00d1db27503df324d5ee773fb9a833f0af00ac2f3cfe6c2d1b90e3023832a

SHA512
039c02c8a82bf1c26a3c8c68e077768f17b027e777dfacbd58553175451a35f2139d2c2d1317dc5b6c114006d463d6945e48fc52e8052be27a5c05da7a3e4cac

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/settings.xml

Filesize
134B

MD5
8db9484ded18dad5f1f7848c74ed51a0

SHA1
7a386acad96c901de974ee8d3e13653c2622b348

SHA256
a51a9cf9be177ae20da4ed5f725b299939e84c6d00a482093d3480242bbffdb1

SHA512
1b8c53125ffa1b498e6940e1d3cbcff1ce4ecc7f5114972bd1ef95881639daa17f0a1326c26d022d733a3e3c070c14b2d10379c2c0f0ab5b9289b753145d5158

Download Submit