ermac | a520776bfea89d266ce1609fc5ca3d52e38ae282b5b0cc35455478b3f7f933ce

Resubmissions

11-10-2023 14:52

231011-r8rewsec7t 10

02-10-2023 22:00

231002-1w26asgf88 10

Analysis

max time kernel
523918s
max time network
67s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
11-10-2023 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a520776bfea89d266ce1609fc5ca3d52e38ae282b5b0cc35455478b3f7f933ce.apk
Size

2.7MB
MD5

de425288564e500a76a3e6cb7d00b451
SHA1

dadea7112c2d89b4a9846cbc75fcba7e37df7953
SHA256

a520776bfea89d266ce1609fc5ca3d52e38ae282b5b0cc35455478b3f7f933ce
SHA512

d206d73d1a4cd627402574acd686a6692263c2fd2aebae744d064d8f1cfcfea298ed68f31fccb772ad244f88a5431fed3b6cf1ac0fac48d8c1616002e7f5e8e1
SSDEEP

49152:UzTnQSQG66mqg8cZgzhTytYQCFHnrN1lue8Iwex0GQl6fr9iHDS:UzTnV66uZyTyinnrfluNFemIfJiHG

Score

10^/10

ermac hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral1/memory/4128-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bulosinehipibe.zusu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.bulosinehipibe.zusu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bulosinehipibe.zusu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bulosinehipibe.zusu

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/xPd.json	4128	com.bulosinehipibe.zusu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.bulosinehipibe.zusu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bulosinehipibe.zusu

com.bulosinehipibe.zusu
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bulosinehipibe.zusu/app_DynamicOptDex/oat/xPd.json.cur.prof

Filesize
3KB

MD5
31dcc81286d51f4984eb291a0a562a7a

SHA1
aeab2d15ba3bcecf526b5d4f2818306f6720adb7

SHA256
92ca4e78722380178a5d557359f85256a2abdc5ee4fdb11be0a8688d2f720d19

SHA512
709d1188f7090381e082e6b0cf5d1234d87cfee22c6680f74bc39c861dd933b3d613e14d9f8d320ef355270b96ba699ad3870ff571e9fa66cb1aba6d834f2331

Download Submit
/data/data/com.bulosinehipibe.zusu/app_DynamicOptDex/xPd.json

Filesize
675KB

MD5
0d7011aae5c495eb21bc14fb36274b37

SHA1
1688ae0e296fb51bd5e2e1e5e6d69f485dd595d9

SHA256
ec05193f495dbd4e80fe15ef83aff93ca43d57acdb397470c74c983d80898ffd

SHA512
16707e9e653b1c49969371a7a7cd66e1a052ea7aa6408ade08956356fef143c83f07987d43bbe5355f77aff826e1d38f2a66c7c4b43b4344f84e526e0bbabf9c

Download Submit
/data/data/com.bulosinehipibe.zusu/app_DynamicOptDex/xPd.json

Filesize
675KB

MD5
76da66ec311b117dd6dc9847d23c2306

SHA1
1d22fa205027f21d2f528ef32e377d6c20a15bbb

SHA256
9c2a5fb6388857a4e5dcf1c509cfada357b3fd0c41df04745aeeb9895d4b8f85

SHA512
73a4284dc624cfb28e5e0994a2560f0cbab95c7e9cb3ceeccb9b1c5ddbb000a0f59265b2b4a0e48a2e9e57a6d531feb98ea3b4a92a2c4d815ba2135e0a16ce78

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d6f5be42123b1a64f8e698d729da18ca

SHA1
be8dc8685a94327a06c5e84f6835085e308fe947

SHA256
f108fad58a2dc8693060fcbb6e3545df855ef2f92b181a423e0eca57dfb3f083

SHA512
29c93bcc5822b07e1bbf8dcbb15288748c9a6c3d5729d373fc274e26290a05b57e5cf03a6739b5a25003f32ed6d59bfcf464da0b7444b07994da19b5a55ce17e

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
63bf96b6fa3f3fbb7afe6a5605433fa4

SHA1
b59a6b78754c24378702b66fac5423c0631d62b7

SHA256
d04e746935f1b6718096257f438c6f9c2280636505ee2cca6370f988278e0a74

SHA512
51e7073977f34065ea15fde121ffd7ba6548b8276349c958c2a653452ab9fc18e4485448749ded8b4543c7953da4488ffce2a9925fccc5656a08740e9059ded7

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d6a3d0a9afe73cdaddcf383bddd19aac

SHA1
38ef559084e6261d72acb7d4d3f674e7ee91b21e

SHA256
4deb57e954ab42fc876adb233ea0a6e25227149480ff2a0533f5e4ca4f517c45

SHA512
b1b7ba09ea4c93dc9c71dfa91edb7b51846f97e9e3c4df8ef671aea6d9107181922520f90f103e1bd2e39653f6439d649ce759536501a395b7ab96cc6df11cce

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
059100a520d17506d554af08f73b5843

SHA1
30995f3f3ec558fb8761914bcc1792d41f17f07a

SHA256
7d291f6ef9a65e7d315d29649814734e2933db86fe3b1dc8b80a0532dabbeb47

SHA512
6e8884032ead9434123c3e3702b9ad96fa13f7fe5fa0a0009702994f1644893808fa3a145673a9b0d8667ee0dd3a9aa8b1e6b5906f9a8cca949c6341a002896e

Download Submit
/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/xPd.json

Filesize
1.5MB

MD5
ad90592ba1bd967fb65ef9eb4cbcb6e1

SHA1
a12ca9423455034bca28396a4067783e33818c55

SHA256
baec4072b1157a3179e6a3d144caedc96cd6afeebaa27da6a0444ce3d41c0908

SHA512
d19c6c46b2161eb4614c7b48ad1cb008bab1dac18d19dcfa535cbb670b8badf64c6eb37105624b6bf868084d5a47ff83670fe3dc69e075e6b75dce857fe307fc

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads