ermac | 08d4f2f90e1adcd801c3e3dae90e5b0680941d49e0ff426291ffb0e32868fded

Analysis

max time kernel
4080409s
max time network
49s
platform
android_x64
resource
android-x64-arm64-20230621-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20230621-enlocale:en-usos:android-11-x64system
submitted
14-08-2023 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Update_2.apk
Size

2.5MB
MD5

74867338c06a1f272c438061fef7cbc9
SHA1

3893e622353dffcc1a98f37503aa6cea4ff539a4
SHA256

08d4f2f90e1adcd801c3e3dae90e5b0680941d49e0ff426291ffb0e32868fded
SHA512

4096fc3da212fffe8a650fe1121e48823eb78c5ea9206c95d41122ee29b4d87839e8523df7948a22eb347eb53dcb3f28f5ce3f79f07ed1ec9b4365bfe100a3cb
SSDEEP

49152:3RW2M93mpiIZTVpMg86GaoXyAT/98+Pe5eN/Xqgp7yQ0:42e2picVpxGaWy2c5eggxyP

Score

10^/10

ermac hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral3/memory/4343-0.dex	family_ermac2
behavioral3/memory/4343-1.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bugomadokijowa.vokusaya
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.bugomadokijowa.vokusaya
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bugomadokijowa.vokusaya

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bugomadokijowa.vokusaya

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json	4343	com.bugomadokijowa.vokusaya
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json]	4343	com.bugomadokijowa.vokusaya

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.bugomadokijowa.vokusaya

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bugomadokijowa.vokusaya

com.bugomadokijowa.vokusaya
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4343

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json

Filesize
674KB

MD5
1bbc4433156d2aa4851868d91185d1f1

SHA1
34d77f845846210fe53fd6e0a4c3ac4ed623ccaa

SHA256
e594d7411adae93edac426b94f6fe467b735636c309822607e209d923a703057

SHA512
39aeea849058d849689a45d1ad71a90e599eefd88261ca880a12e873e3faa49d7b30e2c7bfff317f124cf809c3624167c62c477225fa6931f45c048cff550605

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json

Filesize
1.5MB

MD5
e5655b6086c37472ba5e4d6875a46632

SHA1
278e74bd60c8682c8dd06ecf349f61fab3d07977

SHA256
1194d345776a065d3b46dab0d3d00651e69921cd0d94d8c8e8f3c44c8f781944

SHA512
9eba6c1427ecac5f1783151a2aa3d38b3dea26ff02e688d0cc92130abba154ae398676514603aa8cfc90dc7bab4e0b4e51e60f615871947e58282fa5b08b83f8

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
c0c0c1504cc781676310a94f9db2356a

SHA1
65bb0ea1fa33f794e67263a45bcceb3c027a1bd6

SHA256
02a217d93e7e023a0d0230e337a597207a2f887a368a5cf7bbd05689a1806424

SHA512
c998a8247df35b241ea2ef43207bdfed5071bcbfe3df6e1025545f2b9a9b76ab688a237ae6d4d3feff1cb1668f3fce2fb4115bf35666ac0a2a8590ff455dbc0b

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/Session Storage/LOG

Filesize
139B

MD5
b4d111a3e7f1e1f9f8c6c64b1b352dc0

SHA1
198bfa5b2cedd04d73787ec3265141f8a1dafe5e

SHA256
87aee069ccd74c3a049644e53830e114be57a263a5f45bad4fd7edad13a0ee3a

SHA512
ed783e2ba8bd7b1e7a6fc334ae19b7861d8f60f1bea652e4d2db767c887571ed7cf88bb83c27e1fa09976ceb30399e7d8a995a274760b8d8e6a6448e6e809066

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
817aa9ac45142331971321a80c66dbbf

SHA1
a730e5ed06aaeab06c9eb1da961f297f2bc027c3

SHA256
d5461b1c4827a3daf12b9218fa1eb830bcf0ebe8a93dfacb5dae7ae3bb54a193

SHA512
4a428fe922856beb4635d00f14ef8773054b34a4459cebd37ed68f5cde5ffdeaca76ad9e417352e7da0cec03d6e47b330e2bda797c51c903b73930e23cf8401a

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/app_webview/webview_data.lock

Filesize
33B

MD5
6183732ce589108b47dce9123dfcb011

SHA1
90e63db7659a62e73e9ce1154d763aa7a05910e0

SHA256
41a0b10e172461c23e99f8cff28855fd1e5a13bf8d14815a84ca592012fc0ec4

SHA512
6c8f5c8ce5275523f9fb5d0ea6454d3db4a2591545055b2e645b96c850e058199504e9bb28d6b88e47fda0dde83908e6ade873bc691902a856e45f84b00502df

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
dc0ccfb107c1fee218e711f8276e875d

SHA1
98c9247bc6431b4c3cecf277e2dd3fe8883b0482

SHA256
64c6b9fe58e457f70062caa0794a07fce444b03cf10a6cc21e7710f7c717cd73

SHA512
689c9b4638dcd539500bf103f0bc707c069c02096bb368e49981b893e849139ac5dcf8fb20923e23065796b09ccd8ae15653628a3f8cc788ae029d2ffabf2006

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
6e876d19dbb66c421d37d3466fe26c12

SHA1
a7e40d8cd4bc6e93ede125bd079aee0715017c26

SHA256
fc29c1a16b29b44de164ee9a6d631d4a86cd339cdb49bf3de61fe748d6f16312

SHA512
e43f718f715d6c85e6d61632659b10712331ea81c3949daa2d67f9978703b83c437f884bb36e4202b5cedd6ea2772b098fb5069a551aef0e7f59a5956ea2dd8c

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
f18eff0cacb28fb5637d7e3a51d8367e

SHA1
aae5aca3fd2eeaee39e9446438bbef0f4ef07e38

SHA256
c7b82efdd2b8bf3dc52c79a9ed30f453708bb5ea1d069f22a3ee016c9d5ac093

SHA512
f82d8123d53910825327fdc18cff0b97dcfa11663d0a5ca52f4d2848aafcc24a6aab70235e1161f3087b18c51c8c365a64e6c2ed205b8876f6dd9b8c5e26cf7b

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb

Filesize
8KB

MD5
e579a6b00eef1318f9166352228eba18

SHA1
76988896854f0139083e77862eea1a4846cf039f

SHA256
4b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935

SHA512
c47632e957d87727bf6504a82ca7a44d8da24d30cd997a0f449a96e4f97c656a1b4d9da3fcd827e2a48c59677688da0b872358ebd0f9369d898d1b8ec18d5699

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb-journal

Filesize
1KB

MD5
34d7d37ffed971cf76f71d99549f4938

SHA1
38d4cda1494d40e1ec6998a291895169864cfa2c

SHA256
5699b5542aa6e1707ccec463b139d3d38de685b135cf60355f6d0baa87635d01

SHA512
c76210404c09b7475407c7ce8bca3876775067b78a05c8804facb31ad19c3c5c1dad248d70fb836ab594266f94755bff00f1ba382c22fbe684041794cfb838ce

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb-shm

Filesize
16B

MD5
4ae71336e44bf9bf79d2752e234818a5

SHA1
e129f27c5103bc5cc44bcdf0a15e160d445066ff

SHA256
374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb

SHA512
0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/no_backup/androidx.work.workdb-wal

Filesize
346KB

MD5
90e65e15d899d55c497151ae083c7816

SHA1
24073e7b155a07646de5e924704c669d9f884872

SHA256
917c4b5ef426c7a68581d9ee943c89d1122b98b59541553403aa1163125db132

SHA512
003262434bee186236f54787f68783e8506c6c3bb2357b1ab6e4fc6f8c32072645e50708f325b628ad939740d39343f1ece0ea9a1b70a010074b34643d8618b7

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.bugomadokijowa.vokusaya/shared_prefs/settings.xml

Filesize
140B

MD5
fb7f9d886d0a3b1205cd645b22d60ad9

SHA1
013236f02e6dd94bc90ee2791d83c7adc885dd26

SHA256
bfc4f62e4351eaa78f0c20c2ef357bd4eaa3cd35441142ebc098a2b704198c52

SHA512
940b6596af3684104ac3d11612e261d6036d716f9c9cb13c62c58dc86ba0254cf72598d691d73800655cdd5647e9e0b3abec4e6db89e5a76e8a8ea4a94cf9f9f

Download Submit
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.bugomadokijowa.vokusaya/app_DynamicOptDex/OlAIOFd.json]

Filesize
1.5MB

MD5
e5655b6086c37472ba5e4d6875a46632

SHA1
278e74bd60c8682c8dd06ecf349f61fab3d07977

SHA256
1194d345776a065d3b46dab0d3d00651e69921cd0d94d8c8e8f3c44c8f781944

SHA512
9eba6c1427ecac5f1783151a2aa3d38b3dea26ff02e688d0cc92130abba154ae398676514603aa8cfc90dc7bab4e0b4e51e60f615871947e58282fa5b08b83f8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads