ermac | 912c4c52e1d61021a098d93e4c8fcfd440e368c7ed60cc6feb180a993370412f

Analysis

max time kernel
2518756s
max time network
130s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
20-12-2023 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

912c4c52e1d61021a098d93e4c8fcfd440e368c7ed60cc6feb180a993370412f.apk
Size

4.4MB
MD5

3711fd47766af210965dfd48329385cd
SHA1

a7cce8953ef22f62dc8f0948b90ef038b8c6a777
SHA256

912c4c52e1d61021a098d93e4c8fcfd440e368c7ed60cc6feb180a993370412f
SHA512

c73bc4830f21d40483ccc545068c5406b01af55ef1fd2535450b1d2f80009505d663b6d1f5750b1b43c942970afb61e5f45afc9d364aa53d95d5c75b612a962a
SSDEEP

98304:P9tO+8QPTmJJvqhfSYF4f9yLtvp0DtfJLdvP7lcNuBH3SMWdu:PmECmlSYFOAF6fJxxchMWdu

Score

10^/10

ermac banker evasion infostealer stealth trojan

Malware Config

Extracted

Family

ermac

http://194.26.29.28:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4285-0.dex	family_ermac2
behavioral1/memory/4257-0.dex	family_ermac2

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.lcjoxpsju.bpevqsbzq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.lcjoxpsju.bpevqsbzq
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.lcjoxpsju.bpevqsbzq

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4257	com.lcjoxpsju.bpevqsbzq

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/base.apk.fIUyTgw1.ttj	4285	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/base.apk.fIUyTgw1.ttj --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/oat/x86/base.apk.fIUyTgw1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/base.apk.fIUyTgw1.ttj	4257	com.lcjoxpsju.bpevqsbzq

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lcjoxpsju.bpevqsbzq

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.lcjoxpsju.bpevqsbzq

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lcjoxpsju.bpevqsbzq

com.lcjoxpsju.bpevqsbzq
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4257
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/base.apk.fIUyTgw1.ttj --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/oat/x86/base.apk.fIUyTgw1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4285

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/tmp-base.apk.fIUyTgw5320015273508726916.ttj

Filesize
757KB

MD5
3be6c135e768401db0938413604e7c76

SHA1
f5a425adfc9b4f08eefebf4e25b038a9ba4ef240

SHA256
94c5ef95ff5d68ee2c805fb9b1e6132f7e30ec063690a2ad0673ec4181f0484d

SHA512
0ae4a2c431b34fb2d123d94db614ae30edd348eaba7ce07b6659ff5d277d671cb0efbeba07f91846dc3b00dd773835620fb01c8f6d4f1461bb22bda14d680e22

Download Submit
/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/base.apk.fIUyTgw1.ttj

Filesize
1.4MB

MD5
7cf51e0e1d1d29a8ccc9f4c975866eb1

SHA1
ebe945b01165276e699677c4a32a15ce760acd19

SHA256
03c4e1cbb5bc8732f30cd530eabeae39820c5b0d37b6743e685046c43e686b38

SHA512
970d4aeef0b16e60c6de540a613eab5156e5f736f6f3b74a93a9b7da2c578755cbf9e44643490c3986836beb091dae72259fa9016928eb8242c0d6971f65fa4e

Download Submit
/data/user/0/com.lcjoxpsju.bpevqsbzq/afUg8UUIwT/gg8fiehU7U9iIy6/base.apk.fIUyTgw1.ttj

Filesize
1.4MB

MD5
1724a91975dbe7489ec702aa38e47657

SHA1
846147a020bdbc6932f96c3a38ac38b30c763f10

SHA256
0abfb54a654631e92b7921390b49f9369530e371848a4f4f599aaebb1bbe938e

SHA512
503edec4bee491f79f1a1019fa5afdd8e3a1ae9ee760861ad2e43b407d2c684ffce8f516b967996f24fb1faaab9ee32b68c23dcb8be976e39ad84466bc0a5868

Download Submit