ermac | 739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb

General

Target

739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb.apk
Size

2.2MB
MD5

366134f007de0bede5afb773774c4064
SHA1

62bec235f1067baf34a0d0b93dfb63e554e65071
SHA256

739d83c8ca63e674d56bc4c6024eac790d66d460c27437f47009fed834d47feb
SHA512

11b8f919c2a2b92d3e8d48a4f586bf5c13123e976bb4980372f80d57bf43b65e8fdd04e69f4cd1c3a293da58c69cc7d4a0fcc4b4cdb5fa4f521f54a0011caa1a
SSDEEP

49152:exu1Da69wU3VYuxhVCrvSU4fqrHvQBTR1oGiMl0:0uDauwUFYWh/UbvQBPoh1

Score

10^/10

ermac banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

ermac

C2

http://193.106.191.118:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4273-0.dex	family_ermac2
behavioral1/memory/4248-0.dex	family_ermac2

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.majosiwuxexeku.poniva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.majosiwuxexeku.poniva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.majosiwuxexeku.poniva

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4248	com.majosiwuxexeku.poniva

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json	4273	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/x86/lTdXiAw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json	4248	com.majosiwuxexeku.poniva

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.majosiwuxexeku.poniva

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.majosiwuxexeku.poniva

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.majosiwuxexeku.poniva

com.majosiwuxexeku.poniva
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/x86/lTdXiAw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4273

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
456KB

MD5
c8dd7c66784ff7c7a55a0f018d5ba5e7

SHA1
f848b1a001bbc32709b6b229fdb460274d161167

SHA256
6243db51ab4a20ce9c8c5c59235347094c222e162944ce0b0958177c24f81f71

SHA512
33ba5c2c642deabbd306d80530499545148f2e2b14d8599fe4e986709990cb1a301bff6f0b11ab4ca33b59cf04036b3e8427dd85e6847d231a3b0e5188a8b90e

Download Submit
/data/data/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
456KB

MD5
1ca700f9965eb02a4994ecabe13abdef

SHA1
637b3a9057ef68d7be2eb3ba3650058e232c07fe

SHA256
b251f5abb6a9f0ff6b4e8db24716cf4a164904a3f0690c373af8fbd0ddb3300a

SHA512
ff2cbe43ff3fa6f1dc4ebbf713dbd9f9740a8e8fed64f6210fd1bbcf9a7a6e859b3cf5f064360d6262bb1d806f5c39abc2682574fac60fa2a5f8c22f024034f4

Download Submit
/data/data/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/lTdXiAw.json.cur.prof

Filesize
644B

MD5
7bf1bba1f837807116d3b653b4c87a30

SHA1
3a35aa01616a9c60edf03d0b8560aee27307fd2f

SHA256
a617ebd74adfc657bc3d4e76e7b6de801a7289dd8c8894f7c68f0443cee920ce

SHA512
43f5e7fd143ed2af134a3b98680cf39d6f8380b1ea03c2ebbb8aa58e790db9342b97403b64a20f2ebc05ae6651b9824fc11207907125f6506f9de1c8fdaa3b4e

Download Submit
/data/data/com.majosiwuxexeku.poniva/app_DynamicOptDex/oat/lTdXiAw.json.cur.prof

Filesize
723B

MD5
bce8ac59bd7354325c80049fa3fce761

SHA1
6c614720b4b8c1102c74f78ae89f84762331a9e8

SHA256
3b49514aaefca80d8d9bd043d6323ec6aa7c1cc10e50844415e77970095dc995

SHA512
9c86bce263f2a27bd0a3c61e65ee38fc90710d1cb1cd2dccd0ea452b3d4657c26c3ee0346f4ab3b558991da6f7ad84f28afa3609e27347f0994b5b59e7c4a024

Download Submit
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
899KB

MD5
47a2d7399bc060adb4151493878fc7d5

SHA1
952665dd924b663bb236e8fed9807de42244c629

SHA256
18f927bdff087c24e380287d48048eacc015157e33f0909d3d6603e98e7f2214

SHA512
a327eae38ad394609b489e44150877051e23b2de3093f4b96c4f3538be6ccebdb028338ce142e32947015a4ad4662fde70769d8381a3eec841220ceff81e5d06

Download Submit
/data/user/0/com.majosiwuxexeku.poniva/app_DynamicOptDex/lTdXiAw.json

Filesize
899KB

MD5
2bb06ce0b418fd54fa36013d131be94d

SHA1
a6ee5722c0d0c0dce1d3524d29aca334588c509a

SHA256
2e3a210d1821ff63420c1018a7598e321b021c4a9e85661b8d6714c4c379b75b

SHA512
6de4702b7a2e381de4a368e814fe6c3251d1b90d8ccc9753bd50991205cfbc7832eee158a2889f3d8f861edf0ebe9d6754af1851faafab69e1ab32e50e5e53ec

Download Submit

Analysis

Sharing