ermac | e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b

Analysis

max time kernel
273015s
max time network
166s
platform
android_x64
resource
android-x64-arm64-20230621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
submitted
01-07-2023 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chromeapk.apk
Size

944KB
MD5

a7b751b410822403adf979e12e011815
SHA1

927e3fe33a7105ffbdd9fa2fba6d260aaae71506
SHA256

e35aaf008196e4d7872b5159772c8a5645f61423a5cb073471fd08e53007766b
SHA512

7bdeb598c701a7c0ecd608b34c7782d8bfdb2d85e290a838866fc412e0c22c4bf0de1daebc657de7b9c259777a0eefabc27c4016ebd0b111791ac04435df7bc0
SSDEEP

24576:9iAKWox06kfot/buzE00bl/uRWfqFOVcomxg/YSq:UAvox06kfA/b8l0bl/uRGqvomxg/S

Score

10^/10

ermac banker evasion infostealer ransomware stealth trojan

Malware Config

Extracted

Family

ermac

http://176.113.115.150:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lexujemiyunu.wana
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lexujemiyunu.wana

Removes its main activity from the application launcher 2 IoCs

stealth trojan

pid	Process
4483	com.lexujemiyunu.wana
4483	com.lexujemiyunu.wana

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lexujemiyunu.wana

Queries the unique device ID (IMEI, MEID, IMSI).
Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lexujemiyunu.wana

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.lexujemiyunu.wana

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lexujemiyunu.wana

com.lexujemiyunu.wana
1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Acquires the wake lock.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4483

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lexujemiyunu.wana/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
ac5de794f68f2d6531bc32a836eff506

SHA1
9e8c5e1fbafecbd9be81b1b92d44ef53f5831e2c

SHA256
f5c79e119bf240ee5194e4d63c7ca30dca3b52d5281170aa3bf5f99699a52e59

SHA512
0ac05a2abdca07179b54ac1fecb57cf0c677ee35e441c09ce1b5fdfbcf05b0757e46ff4acf6365f2f2b10279087e8d7a39f100f52f15e3d21787260a9f42c9ed

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/LOG

Filesize
133B

MD5
887324e8c36e36ec43cb63c0964988c1

SHA1
8b9d09fe0857e39c8774f9cdbac2a9e0da505e7b

SHA256
2fffe2ee47b47b6f759526b2b902c048315528df215e05e6b6cfe88c0ec89ef0

SHA512
9cf9bf9a4f0ab7624e6d5153e0452e5ff75b17f4551231cbc07d10e32a75d3b199d2d807db4b2531e52277693d1164645a94e4e25c1c369809113591c6ab8e08

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
0c45546b449c0a1afec7a22867d8e9a9

SHA1
587d5ec8d2010af2e6334c518050023192c567cd

SHA256
8120ac2c9cf977444a7916194187f4c26c1057d6304f41226b81884d3ebf33a7

SHA512
bc2abfbb0e862ad0ad9a7300defa5a630bb433b4247d3bbc12c1c57f1634a30e73c80a0c1de01a56872245f0cf2ba722c4cb995a2eea0206a8db4cc79af38a86

Download Submit
/data/user/0/com.lexujemiyunu.wana/app_webview/webview_data.lock

Filesize
27B

MD5
218e4e16aed69092b1fb22a7eb946321

SHA1
c727c7fca87eb23a9da750a3c814e6ad4c999ede

SHA256
f298c48c9fab12beb083c316874e39d24ad3a4d800aae53306e35306be75e68c

SHA512
b429bced84d407ed7cd2c47f10230efe68b2c54c538a2383e759830a60759fe2c918d1e32a3569e1d9fa5b6784c2236103e69ce1a6d21235b44d7bf22e0e9483

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
57bd6ba0eed32691526622fd41f65fd3

SHA1
126353c4ac6ea63c16a2204d2383b16ac83a3766

SHA256
1780886093f1861b74c4d09d3a6c1d3f0dacadd6b07f2ceffdac1ca629a79a3b

SHA512
5bc85caa449b3acb8ea84dbd76886dc5255c9f3e3f6f3bc194e1e67d06a7c098699e426046edd13335559f3b917b1421811da9c676b0b4a34ecc98c1572d58d8

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
f47355d9fcfd90f3932e85c0e6394ad9

SHA1
e14a8598b9fed711b2dd8441829b72d5982547d7

SHA256
5dd0bf339bb048601031671964083e657bb0d7440e7a020f31cd78a2600a99fc

SHA512
3810e79413cd0a7182bcbbb3efe5aee6c3de50ff2592ab898c61cda8779e26f2f33dff99757cf7772e9059eabb83f682aef135aba8b4d9385b8611017abf3c8b

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
b22d9ec0a4bd3bdd462348d9cee518fa

SHA1
445acf08db4792175e38ecd1919a0ef81d03d624

SHA256
eb0c84fe17e9b5f60a077bfc5868718b283e124bff0556441237b85d17fbf7f7

SHA512
1d0012eef6e8411272616087b84d802229b9e905c25876e97649ac74fc741541900e082aa207356f6b662cceda90e77708bf9e57b4017669172fea02b7e7b2a6

Download Submit
/data/user/0/com.lexujemiyunu.wana/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.lexujemiyunu.wana/shared_prefs/settings.xml

Filesize
134B

MD5
8db9484ded18dad5f1f7848c74ed51a0

SHA1
7a386acad96c901de974ee8d3e13653c2622b348

SHA256
a51a9cf9be177ae20da4ed5f725b299939e84c6d00a482093d3480242bbffdb1

SHA512
1b8c53125ffa1b498e6940e1d3cbcff1ce4ecc7f5114972bd1ef95881639daa17f0a1326c26d022d733a3e3c070c14b2d10379c2c0f0ab5b9289b753145d5158

Download Submit