ermac | 9a44737d1f50f976e29b5e5d2dcd20d6c177df9ad7714eea707905261647ee0f

Analysis

max time kernel
2448298s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20-12-2023 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a44737d1f50f976e29b5e5d2dcd20d6c177df9ad7714eea707905261647ee0f.apk
Size

1.6MB
MD5

626792edc0cd3f8e57c65e2d0af0345b
SHA1

4f1f32166aef396a7bfe4d6e41e25558c01e6872
SHA256

9a44737d1f50f976e29b5e5d2dcd20d6c177df9ad7714eea707905261647ee0f
SHA512

bcd8841170bcd21cc1f5efba444b69f704684fe36b96042c0bb8084fd0dabd6d7441c5522b88c4dba87dab1d2a13a1f867ccb12400c2666de463592328f30528
SSDEEP

24576:e8l+EV68EsEXGfcUG4fwCXTI0IEMcwzSqmx6tQMZyHL9c1S84D9ToRodEHPIPcD:Z67X2kUG4f3TIcoQwULi1J4VoROQ0cD

Score

10^/10

ermac banker infostealer stealth trojan

Malware Config

Extracted

Family

ermac

http://62.204.41.98:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5080-0.dex	family_ermac2

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yusozofasuga.dadoduva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yusozofasuga.dadoduva
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.yusozofasuga.dadoduva

Removes its main activity from the application launcher 2 IoCs

stealth trojan

pid	Process
5080	com.yusozofasuga.dadoduva
5080	com.yusozofasuga.dadoduva

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/weTGK.json	5080	com.yusozofasuga.dadoduva

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yusozofasuga.dadoduva

Queries the unique device ID (IMEI, MEID, IMSI)

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yusozofasuga.dadoduva

com.yusozofasuga.dadoduva
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yusozofasuga.dadoduva/app_DynamicOptDex/oat/weTGK.json.cur.prof

Filesize
664B

MD5
bad5ac4546ad20653d2b1a9a407bdbf9

SHA1
39aef8198e67c3f0e799ef7be33f4cf2ca727d92

SHA256
d7340fc40a413e3ec46dc50cf9c5d92a3be832444c68006c6e8280cc269a4548

SHA512
ff510a210c8c57c3dc975b38bee0b4003e4bbb827b7ea44e1c2464072a4be1d5669ca4ed0448bfdb418e85872e8e29d13e541e6cae04efca00dcb63c9c3525cd

Download Submit
/data/data/com.yusozofasuga.dadoduva/app_DynamicOptDex/weTGK.json

Filesize
451KB

MD5
fb0ccc23b27e521f50842522a3f43060

SHA1
cf013753d4e2025e6aa9dfa67213f463a033f32a

SHA256
9950122a97a7c649b805d8fc521357ab6d2607adb1b2eb6f9a3fbe86b99bc9d4

SHA512
71bd95ba79ef338c0b178ed210bc756ae685a60b0e463ffddc08ccba398c8f63f64aa18e4eb0e2c2897e116286ebf6c6bf71e4b69183daf5a690e2df356469d2

Download Submit
/data/user/0/com.yusozofasuga.dadoduva/app_DynamicOptDex/weTGK.json

Filesize
890KB

MD5
ab16e04b52e006b2f1317a485000359f

SHA1
dda556bcecd7e19fee1735fa10562d898452ecbd

SHA256
7d7c413a2a2787545fade0ebe201eaf98091addb245d9581b587cb06de8b130e

SHA512
ed7447330a60f5e5f94220d2ec53bfccbb838e0b664c576665ca00b2273862350d86cc890c2b3904e757a408b0bf4554da394401f099aca8bb551b7450d48699

Download Submit