ermac | b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2

Analysis

max time kernel
1687418s
max time network
72s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
17-07-2023 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2.apk
Size

2.8MB
MD5

c909a9df9dc4c6508eb4cf7c68aa5293
SHA1

0adf0df2c56c8b76b27abde0e73d18bede6c8274
SHA256

b3ee8c90d9038c94565785ba2eeca0362de853a6324e3c93736a22eba09b50f2
SHA512

782e63f86e8662230dc3f22bc872ed54a8a4e8284f965c869831bf14ee2ce0dfb83a473031b4bd9579e205928211498c75e06182063fcf8c26ce6b254b16831f
SSDEEP

49152:LTMV/hemABwhkqfbDU0g8fYz5mgzMTym95CFHnrNUlgocZFWy3ACdv3IFoBQ/g:LTk/zRbDU8Yz5mXTyuynrWl/cZco52Fe

Score

10^/10

ermac hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4145-0.dex	family_ermac2
behavioral1/memory/4110-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dohisoyumokexisi.jufosiji
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dohisoyumokexisi.jufosiji
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dohisoyumokexisi.jufosiji

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dohisoyumokexisi.jufosiji

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json	4145	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/oat/x86/xCB.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json	4110	com.dohisoyumokexisi.jufosiji

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.dohisoyumokexisi.jufosiji

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dohisoyumokexisi.jufosiji

com.dohisoyumokexisi.jufosiji
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4110
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/oat/x86/xCB.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4145

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json

Filesize
674KB

MD5
175bb924fc9f89f16a75772a8d9f152b

SHA1
04b1a438617f073751cf5347e3cb0ee95dcff32d

SHA256
3fabd4daed04836e54116b2d44af9027e32c3d5b7a1075d2399e9a5ba3bf269c

SHA512
8aa3c3e74c6a2a2f0d739e7896157ebd62c79bf4513435b9ed666bc3b5a08757869fb0594d9ad685f6b40e4721a0c931674c6900768410e172322d332d48ace6

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json

Filesize
1.5MB

MD5
89c3aff2a95a6d0aefef7028c45bfb18

SHA1
614c3d8cc88388a1000a96d46420f0bba34f7a83

SHA256
7c3215f5942fd1ea7f7a46614cab764740d39f8db4a76866b943077145223f07

SHA512
a63f7599e5513e7ccdc3c56cb5e1e9862e8b1464088844d9c1f1e082287b76a270ff7454e9aa5336d9d3faf51d4f92b19950a4a337d6e7288ffd0df0a5c75fa8

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_DynamicOptDex/xCB.json

Filesize
1.5MB

MD5
e0eaeebcf53c831477bc5cd6b908822a

SHA1
3ea42012ab8fdac61426eb494a51f755a6d331d0

SHA256
84765b800ce4182b581719ad1fb35afdea8e0dc20f47b025a5df78837a91fbb6

SHA512
626605b9d3a5e7dcf3b582cd56aec18a99d7beb23df99323de9924b7ad86b442ce9d8213710a54fbb47ad965e1caa09c7bed7b704a531154450187f590d0c98d

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
e35ff4fdf59c14b11d2dd85f758e9a99

SHA1
be4097e7d03b81e6a6b9a716ea79c114197f4c7c

SHA256
949bf7fa181d0e80efe39a65e6611026e435245561adaa9a3e75918506d73e4d

SHA512
21bdfb74f5e3b13a13560606d5351a9dd45f06b657a5276a76b7c79aad68d8ee50ee8ad9864c38d63516c952be7d897fe9a3da8d51c669327baed6ff9e9c09cf

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
9eb342b7c2dffe200379cb7c60b3b6dc

SHA1
05f9126b083a5e4fc04fc63fd3e6be01617aac17

SHA256
21899b7809a5d97485405eff2b90c357cb6b64fa86e71857987b75985594f4b1

SHA512
a8cb031ec02c7164d42d3a49026d7ad298dbaae890b1837d9923a5aa26f252adbb55e76ec64a83fea512349fd2c882bb77c690826bd327129580e78c7e749650

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_webview/Web Data-journal

Filesize
1KB

MD5
e286bc5574c713adf6d79630ae148a21

SHA1
8c018eeb026456e710877d46c9458591d4e6f6e6

SHA256
eb805bbc7657fc6378751cbbe5d795e9194a2e266a04a66e600c71ce0d726578

SHA512
3de64ec49ac89d74586232861e0acfe142feeec97793f81a9c8f042506b24e69257b12d11b210a59aecb27d1815b28bc1d670a7d31446780ceeb67e88cf94bb4

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/app_webview/metrics_guid

Filesize
36B

MD5
fc4d8459f114133fcee7f59124ee8577

SHA1
94241d31de50ed6a8eda850a58adedab77c42a77

SHA256
d839b63c4239c19d1024f5edfbbbbfc7f13d67ad1abd7a6bfb7bdf5791eb3ebd

SHA512
67e9b0f4e9036f941df750c29797f831cd957c020db17fe85ecc1da4ddab55bd1f28448a79eabcf850c3b6a84d29b845d10013b9627d2531d5b505ffb9f94a38

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
f4cec2b2e65533dd51a92c6d6d035cb4

SHA1
bc3d35e523dbc29d2393e5e786875f55bced5315

SHA256
7b8040e49d1343bbf32f0bfa7a72bae0e884637917be4d58d41b1c03c3e5d305

SHA512
dbc93fb61a9a99001b4f2b43ed041387bef5f3e509a88ae0cf36f4959642bbfd1b6b0fe458f1807da305a1aaea811384db6b69dfd5f8c655ed4fc3bcb2a67c01

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
b57995ce1d3d2b456c4251c1c7da3422

SHA1
9ea8a56006c5794ee0efbab0af895fc32a69199b

SHA256
c77e2ef87853f451491cf50f510a57ee0b88a18028f1c34c3d192ada6d194601

SHA512
e901ee214b4783698f158bc4a8dca6d86a267a80098bc8717c9c2d848e08f83e333fdb3679fbe94abe056d05fdda2654bd8a9a2a6567c693c38852e08b300540

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.dohisoyumokexisi.jufosiji/shared_prefs/settings.xml

Filesize
142B

MD5
dcee2cc3108e94c1890b06a34f633fff

SHA1
290fe998986d6cb565433cfd5e6e8b99dbcaf82e

SHA256
19526b94fc37ff19b7df0e19bdc7dbe960b96186f683654a5a74b964d712e488

SHA512
43074288dd10ac080cb89e08dcff115d879275444399f688ce41ecf4c751fc4f4c4a3cc095a5f6a5903ef1cd11dbad2b1d94aa9e59afd9baed9d25e861a2fac9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads