ermac | 08d4f2f90e1adcd801c3e3dae90e5b0680941d49e0ff426291ffb0e32868fded

Analysis

max time kernel
4080406s
max time network
34s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
14-08-2023 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Update_2.apk
Size

2.5MB
MD5

74867338c06a1f272c438061fef7cbc9
SHA1

3893e622353dffcc1a98f37503aa6cea4ff539a4
SHA256

08d4f2f90e1adcd801c3e3dae90e5b0680941d49e0ff426291ffb0e32868fded
SHA512

4096fc3da212fffe8a650fe1121e48823eb78c5ea9206c95d41122ee29b4d87839e8523df7948a22eb347eb53dcb3f28f5ce3f79f07ed1ec9b4365bfe100a3cb
SSDEEP

49152:3RW2M93mpiIZTVpMg86GaoXyAT/98+Pe5eN/Xqgp7yQ0:42e2picVpxGaWy2c5eggxyP

Score

10^/10

ermac hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4146-0.dex	family_ermac2
behavioral1/memory/4052-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.bugomadokijowa.vokusaya
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bugomadokijowa.vokusaya
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bugomadokijowa.vokusaya

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bugomadokijowa.vokusaya

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json	4146	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/oat/x86/OlAIOFd.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json	4052	com.bugomadokijowa.vokusaya

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.bugomadokijowa.vokusaya

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bugomadokijowa.vokusaya

com.bugomadokijowa.vokusaya
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4052
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/oat/x86/OlAIOFd.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4146

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json

Filesize
674KB

MD5
1bbc4433156d2aa4851868d91185d1f1

SHA1
34d77f845846210fe53fd6e0a4c3ac4ed623ccaa

SHA256
e594d7411adae93edac426b94f6fe467b735636c309822607e209d923a703057

SHA512
39aeea849058d849689a45d1ad71a90e599eefd88261ca880a12e873e3faa49d7b30e2c7bfff317f124cf809c3624167c62c477225fa6931f45c048cff550605

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json

Filesize
1.5MB

MD5
ece6b1b68bf8eccaeb64b229512765ae

SHA1
f8bcb69195ba4ae7931d0fd1ecfeaae59010f138

SHA256
5dd101692ebce126173a6aa0b6e78a435bdb220647cdf93f44820f4d96473cfa

SHA512
abfc0141bd86dac6182056f9573ba96a90414d08800bf86a59dfe39f2cb09ae787dbfdf47846f65d34ab618fa702ac23c5828dfce6348df03a77e6bb991dd65f

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json

Filesize
1.5MB

MD5
e5655b6086c37472ba5e4d6875a46632

SHA1
278e74bd60c8682c8dd06ecf349f61fab3d07977

SHA256
1194d345776a065d3b46dab0d3d00651e69921cd0d94d8c8e8f3c44c8f781944

SHA512
9eba6c1427ecac5f1783151a2aa3d38b3dea26ff02e688d0cc92130abba154ae398676514603aa8cfc90dc7bab4e0b4e51e60f615871947e58282fa5b08b83f8

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
adb27ff16c2e15ab50d896eb697346c7

SHA1
a73884b88f54aa3dc45cebc57e90aab3a472fd67

SHA256
dc549566d14c12577443350919daf601305235ae58153db74a6d2b5b075b6bb7

SHA512
0767744e3bfcabf60bac43d4f4f3af57f0b935fd3ab9ac5a22f43d56e5fe4a6296aefd4e28b9cbf7ddf275ae5ca8009c9c3d31c1ea801a90af82ff9fbc1f18e1

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
d6a464178796e16bba33d49edb91a29d

SHA1
c7f8feafbe522f534083994a2cd2d0dfbad1efd0

SHA256
5ec5c97fc513836b14512c8a7e61fe63ee89076ac3e2aafd45192b033c3b066c

SHA512
1b5eed386dc6c5316ff43ced6d3e87e3b1fd25c7206437509a6fbce6b661f274e553ba990bf098474656448558208b3f0cab2fa328956a731693616ef6dfb5a9

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Web Data-journal

Filesize
1KB

MD5
019c14a9f9a1fe548619626d4ee94707

SHA1
a658ca8b2556195b4fb0cb4fe9609702b2720c58

SHA256
1941976f07efff0e389f624feb6993c920bfa72722ddb3452f6d3b2970aee315

SHA512
813fb7af9e285c2ae2f43673c40543402d97329559db50770ec05527a0720e3105714ed7b91ba4097270b04aa67345192afc3f16559feb347659c9b2ec840c89

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/metrics_guid

Filesize
36B

MD5
14a41f1843e8a71bf70c4abf966297b9

SHA1
dea1c65d838b371d2c8a753649141dcb39b839fe

SHA256
d3f48e63274c69c52b1db4ae15c224314d5a60398fe0a5db4f0537b6afcaa234

SHA512
4ba7a9f5f2ff09edcb31eab24693150e401b23ac892d0f9b6897945f85d0d85ecbb4c488e71408c26c62f6dab904aabd91a1b1c6a689df66aaa863426815e843

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
acc4e82d437be4628bda01c1a41593ad

SHA1
d4bee48dce39c1479a413015ecc5f044ad0227ce

SHA256
1f2251ad22c99cd55fc8cca50cd4e82e31974411f7857685c5884f7d64d3fd74

SHA512
e62313f6139fc36696a31c5e735e29caf855eb293fe7506feb49580434fb06faa6762ece699198960a852e4f7f6f55ff4a7ad7f1005da3ab0868d65d5f7eb1b7

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
8426854feb9f9dc270869dda8e176e3d

SHA1
072fa233169f72e968a95d7ca501b5341677bae6

SHA256
738998773b194a2c76c4de69b088fb287214752f1350b97107a4b5054425a917

SHA512
28a132edae7f8899d45b47aad3419946acbf91f7f230da66e26b10ed044558f2ceb1943f1e6e6b181b8d37e1756be84e54e92c08ec06248df870d9d13472af01

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/shared_prefs/settings.xml

Filesize
140B

MD5
fb7f9d886d0a3b1205cd645b22d60ad9

SHA1
013236f02e6dd94bc90ee2791d83c7adc885dd26

SHA256
bfc4f62e4351eaa78f0c20c2ef357bd4eaa3cd35441142ebc098a2b704198c52

SHA512
940b6596af3684104ac3d11612e261d6036d716f9c9cb13c62c58dc86ba0254cf72598d691d73800655cdd5647e9e0b3abec4e6db89e5a76e8a8ea4a94cf9f9f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads