ermac | c92742794cd107cd3aaa340461c8957134af7d6a8c703545be09eadad6a3ebf2

Analysis

max time kernel
14s
max time network
131s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
12-02-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd6509d9fbd70121035a18f0e75b0e5f.apk
Size

3.1MB
MD5

cd6509d9fbd70121035a18f0e75b0e5f
SHA1

ce71b79b5dcdcf2ec07ba90e32baa4b782d635da
SHA256

c92742794cd107cd3aaa340461c8957134af7d6a8c703545be09eadad6a3ebf2
SHA512

b0ed3f65b81102ccee1e539125df2be49390d2dfb90cea32eb439a849a5882db71dc17e4c269c0d777f8e39ffd39418287f3573e92b7b99e3f33de7ca83a2049
SSDEEP

98304:YiFhn+C12SojeGOuIQnHQ9XieS6qke2DcxPtjyK/Cxl:WSojeGnIyHQRG6qke2DqPxo

Score

10^/10

ermac hook banker infostealer rat stealth trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_ermac2
behavioral1/memory/4255-1.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4255	com.rifubetoteha.domoju

Loads dropped Dex/Jar 6 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex	4255	com.rifubetoteha.domoju
/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex	4282	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex --output-vdex-fd=43 --oat-fd=42 --oat-location=/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex	4255	com.rifubetoteha.domoju
/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex	4255	com.rifubetoteha.domoju
/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex	4306	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex	4255	com.rifubetoteha.domoju

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rifubetoteha.domoju

com.rifubetoteha.domoju
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4255
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex --output-vdex-fd=43 --oat-fd=42 --oat-location=/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4282
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4306
- rm -r/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.vdex
  2⤵
  PID:4336
- rm -r/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.odex
  2⤵
  PID:4350
- rm -r/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.vdex
  2⤵
  PID:4368
- rm -r/data/user/0/com.rifubetoteha.domoju/app_ded/oat/x86/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.odex
  2⤵
  PID:4387
- rm -r/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex
  2⤵
  PID:4405
- rm -r/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex
  2⤵
  PID:4427

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex

Filesize
3.0MB

MD5
a4f58f48590f316737de7704977486f5

SHA1
7b10f92b29aa76eaefb3c3a7ced05ccccf98cd5f

SHA256
5d112a6da066dfb7a044671ec12e648190565417d20a97ac901e872f1ceada45

SHA512
41977a839f136710e586eb022904a3d50516467408c08524ad44efde97198cc6398b01a7352893fb67f146b8f8b6aa46d91af8dc28019cb58d326b4a5bbfc5bd

Download Submit
/data/data/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex

Filesize
1.5MB

MD5
8896e9bff0557d5d78c55bbdb0b85762

SHA1
fcb1a2eb344f0180c873758e85008dace02c47e2

SHA256
8a79aa78c46001c76355ac87d12f6bfb3f0d267ce599bd3113014fe936ed4c59

SHA512
a027ae6f9e8d0480d3ec41d947e73bdf5530df0899bc7b777fc2ad07735e232949557fe0579fb3fd606ee6529da1355dd54fd37525a83f64e07eb5d3f7645648

Download Submit
/data/data/com.rifubetoteha.domoju/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.rifubetoteha.domoju/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c4a19f5919a8294616a36cdfc5088989

SHA1
5644779df8dd6328afd67bb3c75f4eff86690eb4

SHA256
2b977259107190605e4d4df029bde9ce76edaf1bee2d5c106a6c20a0958203fa

SHA512
395090d33c161996144ea1bb8f92b965d80adeed842e40f3523866a064a891967a0f916e066fb1b364d1226f20a558ac018118e14c2ec483c3e3e5903eedaf4b

Download Submit
/data/data/com.rifubetoteha.domoju/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0b04e4ef22dba3f5fd3365f1d6b4d291

SHA1
56eea02ad32e1b18605e1f75a65a5aa7f0fa7808

SHA256
fbdc10236808004fc9bdd79394dff95e5eee5d750d873ed8c23b5d63963f5400

SHA512
371121aa6717f5f0e79cbf1710825f5a4d635ccc9e0d9eaf4e549594900808022bcae5aaaa8f2b4f305007f935d15c1b1ab5deaf5ae70b91e700add1a67b026e

Download Submit
/data/data/com.rifubetoteha.domoju/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
673151a4640a95501f14e6be0c7cbe69

SHA1
65f3f205ddac1e77dbdbf3c3fb9174838d165568

SHA256
3f28ac2e5809e915a02e63825a5825394725d31c51043b454f22454fe8de0e1d

SHA512
f8c5d7241e88f1fe60057f90d17f4673dd4240ca35162f02d0d1ba81b0251463a336fabc4416ef66c4206ee2f0ae6744b92f53332b4cb25da2fecb38a885ccf4

Download Submit
/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex

Filesize
4.7MB

MD5
25f4f0398f07d71c274d510a5979cbc6

SHA1
e7ecb46ae314f2ce33b8f5af7a7a80cab7dbfc05

SHA256
a37237f95364e64a60a068ce59a1a9d513d573955b0747940492ecfafd3aa90d

SHA512
0f187f124bd061541fa726f5159556f2ac7c1814e95d495bc92001064a7381a96282e5527ea1528f1564415eff0feda3469696fd84c89e2d2c22ee97c15a6f40

Download Submit
/data/user/0/com.rifubetoteha.domoju/app_ded/21tb4hQ9Uk7cyuOZcUwGFrPHukoVNKWJ.dex

Filesize
4.7MB

MD5
33163b862374ab3bf5b8d2d217553b8a

SHA1
1a1b8d5b4ca2a407de9171cbb40d89dc252c1c24

SHA256
732c87716316f0252d5177a06b8b2a8c884919d9b5b9779b92ff642fc9caf05a

SHA512
5b64e08b36f535f7c1d58a387b292e202a760a22385c957c3ef792522023866dda3044b608d9648d6f319eb9df1121f5c11fa2ab2969e1d30e01550c13ee7cae

Download Submit
/data/user/0/com.rifubetoteha.domoju/app_ded/tJ8dJlAssUFcrqhImQF7TNdib2oilC7n.dex

Filesize
1.5MB

MD5
634b53f51f4e4109233e7f15b0581800

SHA1
509ecffa621420c931cfc9656096860d425440fc

SHA256
0a309298fe82f3340b29fdac83d49292fabaaf4883e2be8a75922ed7d7be881e

SHA512
792c9357d4cfbf2e691439502b4606edc2784087e4b0650e0b8d36ee0077aa97c552d272c9bdedb0764f5e31f2b75366e7ad5e1d0c6cbe85a192fcc21848d4f4

Download Submit
/storage/emulated/0/crash/crash-2024-02-12-18-29-29-1707762569635.log

Filesize
4KB

MD5
3203f2669ea7e58ea9b4a3026b3f266d

SHA1
ebc8a6fbe4f3758833e04a57738d105299605c98

SHA256
5325f67b232eecf0de7dca062f7bf0c2c696f4a5bee430221aaceae7e294f294

SHA512
c700a35621aac0baf2714c7f85fc71e10a0a715da5276ddf5dfd0af062fed9dc5e713174723c3ad097505de4e813f8247997e98d37ae8b7af473c5d86c085e53

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads