ermac | e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b

Analysis

max time kernel
273005s
max time network
158s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
01-07-2023 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chromeapk.apk
Size

944KB
MD5

a7b751b410822403adf979e12e011815
SHA1

927e3fe33a7105ffbdd9fa2fba6d260aaae71506
SHA256

e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b
SHA512

7bdeb598c701a7c0ecd608b34c7782d8bfdb2d85e290a838866fc412e0c22c4bf0de1daebc657de7b9c259777a0eefabc27c4016ebd0b111791ac04435df7bc0
SSDEEP

24576:9iAKWox06kfot/buzE00bl/uRWfqFOVcomxg/YSq:UAvox06kfA/b8l0bl/uRGqvomxg/S

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://176.113.115.150:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lexujemiyunu.wana

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4071	com.lexujemiyunu.wana

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lexujemiyunu.wana

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lexujemiyunu.wana

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.lexujemiyunu.wana

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lexujemiyunu.wana

com.lexujemiyunu.wana
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4071

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lexujemiyunu.wana/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
9824fcd3cff091e1c9400f48b0882f1f

SHA1
16c14feb15d74efb93df468875768fdb85aece7a

SHA256
fba351c4fae6bd33c99302fe199fc6b4ede61e7cf26f5abc1aebbbcdbf9f9942

SHA512
5d5f4bf15e832934f366674d1fa2be2db767306ae0f8a64f5e6dce0f869bee40cc9ed3c0b919afe63906fa0d9fceb3fa1ca9cc724bb6de5d414575269bfd1c81

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
a9f655ab70176da398a0df2882bdb776

SHA1
28b613db4bce8ff4337dbf0df0e91cc314d097c7

SHA256
70a99d50ef51b13e9d31f4541f04e3342aa8df76033b12a902877975fdb3213c

SHA512
dbac4cc093ab90be5c909e43aea3ca60dcd32d10e323148e5c4eaab84e2a9acab3e685aa02b24c576eb50ea4ffd516d0f2d4eafb75513ceae6d15b60f428658d

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Web Data-journal

Filesize
1KB

MD5
ce3cdc28650b43cfd767361039a9b627

SHA1
5b9b638fa5780674ce024edb9d14109d4f86643d

SHA256
290360850f41c6e3c45b115e88619852c25f281132c8bedc1996182776308c2d

SHA512
a24973c4556b142819a7a7c9ab7f7c4551841e6ac3e000ce5d3a860460ad25a173d4250ac069b70fe2e4750e0eb136a461c91f400ca38909012c09387ab444ea

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/metrics_guid

Filesize
36B

MD5
6e27f778e882a46db3f58d4caa7627e0

SHA1
784b6fbdb83a46cda200d784ab030e0bd0ff3a8d

SHA256
7ab31fcd290e8e01c22404bf6fd6e6bde2e30420071e77bc2987324b66754257

SHA512
42242819770430d00f4a791b4a78766f44e88ce63fa8bd51aa4f68dad46f2791390635c9ba46a044c0f3bfabfd275348be5c7b0392f2d2bc2addbab3b54f018a

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/settings.xml

Filesize
134B

MD5
8db9484ded18dad5f1f7848c74ed51a0

SHA1
7a386acad96c901de974ee8d3e13653c2622b348

SHA256
a51a9cf9be177ae20da4ed5f725b299939e84c6d00a482093d3480242bbffdb1

SHA512
1b8c53125ffa1b498e6940e1d3cbcff1ce4ecc7f5114972bd1ef95881639daa17f0a1326c26d022d733a3e3c070c14b2d10379c2c0f0ab5b9289b753145d5158

Download Submit