ermac | 4bc5c2a68c50c8c901043228e9f894c5505decf283b4f4f3f6afb68c8ad260cd

Analysis

max time kernel
2277607s
max time network
140s
platform
android_x86
resource
android-x86-arm-20231023-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system
submitted
31-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bc5c2a68c50c8c901043228e9f894c5505decf283b4f4f3f6afb68c8ad260cd.apk
Size

2.6MB
MD5

8b76ab0c85478eafe3b75af4c7a925b7
SHA1

18e8a50a7578797f2ed879ab392663ce67280e0e
SHA256

4bc5c2a68c50c8c901043228e9f894c5505decf283b4f4f3f6afb68c8ad260cd
SHA512

f0c2b2f2d060845b4db0629a6d6e06cd291e91082c55258ab487c7773565e3b019927339f62b7aaf246bb41cf3009fd808d2bc8e2fa031f140dd7abcbd24bbd4
SSDEEP

49152:mF+l6owv4Jbplifg8P3Xgk+TygLjCFHnrNOlB4yp/uG7/CK:S+kL4JbplS3XATyCYnrMlBP/RzB

Score

10^/10

ermac hook banker evasion infostealer ransomware rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4315-0.dex	family_ermac2
behavioral1/memory/4283-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bulosinehipibe.zusu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.bulosinehipibe.zusu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.bulosinehipibe.zusu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bulosinehipibe.zusu

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json	4315	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/oat/x86/mcP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json	4283	com.bulosinehipibe.zusu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.bulosinehipibe.zusu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bulosinehipibe.zusu

com.bulosinehipibe.zusu
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4283
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/oat/x86/mcP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4315

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json

Filesize
675KB

MD5
a58e4ed5192672222fb3254445186ca7

SHA1
839285dfde1bb6de7c48047bed79637f4772c6e5

SHA256
1fee256809f1ab1be46910668b83e1a2d15d7526d0fe3648ce395d0505ac923a

SHA512
58942bf96cc16a978bfd5d1b776f89d5c5e76d476df091394d889657f5ecc9a1d187279a3749017c0759f86c16414ec0d939ea39ff45504b53416ef266b8b88b

Download Submit
/data/data/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json

Filesize
675KB

MD5
8d17f68b305036465f27cae5b5585bfc

SHA1
eff0501ca441e60b5b03e72fdbca44a591f6573f

SHA256
3cd9b04b986c3cc64f50b51cbf5b006f5664938176c444d828db7150892ac8e0

SHA512
2b29a38c58121ec81e4e6d2b606005f7a16801514d91ea23160babc41824882bd381131c2bfd1049dca397c2492c52d628c8ae279aa3cb4efda63cce03f133e0

Download Submit
/data/data/com.bulosinehipibe.zusu/app_DynamicOptDex/oat/mcP.json.cur.prof

Filesize
3KB

MD5
777a44b69a8d657a424edc94bb9a9580

SHA1
6f456ec14938a99f544a929b99d303b3390fce93

SHA256
49f1c49b031ec74ea66aaa2627f85407103fd19f3934dc7387def1e2ea397325

SHA512
f35a62a0b155da47f9e7e371b420c2799fb3a9fe5c13c9e4aef061eece8ae136970ebddb8bd4491a9621ac0822f81f62a1cd7aa407aea1f1585555160b1a1693

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
b63750510e53ef78e757ad3787d227ef

SHA1
90787854183c50bcaba5041c8bbaa43e3dc75e80

SHA256
86914bc51573f20433930e6fa56a39b647a391207a50c86ff366644824e156f7

SHA512
71e123ac13c217994150350ab445a086570a0d42b1448f995b5c36ff6d812ab2ec4d92a8b8683cd2e4ae1f18a9ba5fe26b6ff336316f5a045dd1dac77e67baa3

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
18fcd53132b8123592e539664a7c4dc1

SHA1
573adc77f6a301559d98755a7e862d7812ecd057

SHA256
153802eb6f02e4520dd9fec426961f057862cad45e5c22b365a138b60aac53ea

SHA512
84dba48b92b49cb858dd36fd10fd2a3a1bdd6ed827788373e3ffb06376c93dbbb3569ccdd32a43a0539541a5ba593d5dfb71591f7466730183c25c330ab675ac

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ada7ef9ea691f567afd314ebceeddd0f

SHA1
ef905049ed92fc093726b7f5a4a1a1a0cbcbf4ea

SHA256
64b8c0dcc8557d54c23e773e31bfa73b5d7dbec108046a51b465111b7da3b7c4

SHA512
04d6e02cf51eb3692b4028323cdabaf2671678119be3dbf64c19df5ae1a3bee8d1f610680d0c2da152e8149e0c53cd84da9895e1204e531d11ad96cc7eec6653

Download Submit
/data/data/com.bulosinehipibe.zusu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
3302195c02017a9014c5b1db98fc2def

SHA1
16433f3b7559d3e7fdbd23aa7770dffef598290b

SHA256
ac4aeefba3f7c40a646b004c9a840b8f656320e652f6a1f4edf258f5d6da7c55

SHA512
445a97150cee622f0e3e3bf2bc2d0baddc6858259e8337fc3f7678ee533362090416b87777bef90a3d7cd9b5d1c10de113b55f32897994e3d81ff7e1fc076b3c

Download Submit
/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json

Filesize
1.5MB

MD5
8f369816ff717a5e5e820914efae434d

SHA1
0f2562d78dda7e32d242448085c5cb145d6d0328

SHA256
3605f7c5f42ee16de28262d088ef0656f5c13690b345f03536ae76bf89eebb64

SHA512
623e5bfa6891ad11e5618490525629aa5d51cd162522e97f40cb99e7f14315007e773abc8cafb86a31a0b189737850ddb4c316707322d3e3e7c249272e5c7630

Download Submit
/data/user/0/com.bulosinehipibe.zusu/app_DynamicOptDex/mcP.json

Filesize
1.5MB

MD5
10ff6ba09437aaf043f3001eaa5e11ee

SHA1
0a67debe9d2053ca265b8ca84713e15f39c73638

SHA256
9c79a22ecf75ee430c297f981bada888f825eb070339221c7febaa4ef197e2c8

SHA512
e28e385ed87c70c50c87f4377409b1e0546cdb29f16c350da3fc418e2c55739813d9c0421c6b053c7b3da54b76d1da5d5afe73495978e0379b48038468d45477

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads