ermac | a43946e9c775ee011f2096fc3c6b214c9ff67120e7cc1fc65a871314c77667ea

General

Target

a43946e9c775ee011f2096fc3c6b214c9ff67120e7cc1fc65a871314c77667ea.apk
Size

4.5MB
MD5

b7b97cf97ff8613287235aa92073a011
SHA1

cb865d41b36de015d18592ffc58e21fc678a9951
SHA256

a43946e9c775ee011f2096fc3c6b214c9ff67120e7cc1fc65a871314c77667ea
SHA512

cd194740bcaad2913d9e5b34e5066782cb239b60738f40cf437b6793404be09ab6c58dfce0927181a8d9dedd5528f545176d21a39c666656cf2b4e670c9fec6e
SSDEEP

98304:2zb0xgao/PDnNCZVmorrJnGNBZqiOuKsVFh9B/9Q0/UN0rU/rWcFqDt:o02ao/LNCZVpXJ8bVXdvx1/UN0rUj1FO

Score

10^/10

ermac hook banker infostealer rat stealth trojan

Malware Config

Extracted

Family

ermac

C2

http://93.123.39.152:80

AES_key

Extracted

Family

hook

C2

http://93.123.39.152:80

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_ermac2
behavioral2/memory/5042-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.yFWrHZpr.fjyaObQj
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.yFWrHZpr.fjyaObQj
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.yFWrHZpr.fjyaObQj

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5042	com.yFWrHZpr.fjyaObQj

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.yFWrHZpr.fjyaObQj/app_ded/J6QHpP3M3VpeP42sXWtgGMHZ0glBSZai.dex	5042	com.yFWrHZpr.fjyaObQj
/data/user/0/com.yFWrHZpr.fjyaObQj/app_ded/J6QHpP3M3VpeP42sXWtgGMHZ0glBSZai.dex	5042	com.yFWrHZpr.fjyaObQj

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.yFWrHZpr.fjyaObQj

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yFWrHZpr.fjyaObQj

com.yFWrHZpr.fjyaObQj
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5042

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yFWrHZpr.fjyaObQj/app_ded/J6QHpP3M3VpeP42sXWtgGMHZ0glBSZai.dex

Filesize
2.8MB

MD5
58ff8aafe9722e7d0f4719ce4c7c9bcf

SHA1
9ffc38ee2486c4f727b5c62fd3e7f00ff342e4a8

SHA256
12a7adf5e827cb4e5415cd2038781ad7c0e1607f08464fbb032ae81bd66611c8

SHA512
d287c639d971df0ee6bd1cd45ab0158611ed578abd9e18e9f0d159e6be16a51e2cfa73953841f1d9b533f17f8e29d7ccdfc5e187d5d7aee930e0a696af97db60

Download Submit
/data/data/com.yFWrHZpr.fjyaObQj/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yFWrHZpr.fjyaObQj/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
33ab08eaeb162faa7ecd5530d62fbfc8

SHA1
9e56b389b316fd2b8cb14da857121ae7a7523728

SHA256
94d7d0b52fba6f56b9f258a0de678e3fd0f1f7d1efc756137092df2f29716b6d

SHA512
ad2fd4c265a6d611a61d33ac4c746bd4a0b4755e40a00b95e3afdc85cb3306fed8de1149222c7819aaf4c5d36e8bc8fbdf4820207bdcf4e504a595021d155061

Download Submit
/data/data/com.yFWrHZpr.fjyaObQj/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yFWrHZpr.fjyaObQj/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
deb38178eb3f3379678f7e5c22cde397

SHA1
476b57ef8810aea2e59cc21ac4e16a8dfed9d3fa

SHA256
40562a957e0c51e5225f5031e12bada56d7ea9f4ce2cc6b15edd2c264f605791

SHA512
64d8c03f003704448061eacaa678015a7999fdf00ee20c8f5f6324e19272923a698914a37edf1ccd3223945432c39c0fdf9a2ce10a51b2b2ca9a1d8ad073351b

Download Submit
/data/data/com.yFWrHZpr.fjyaObQj/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
eceb8066b8ff6df5e3815efa85ea9930

SHA1
0a1f8755a51ad61ef1fc54a988b0eb6cfb5b619d

SHA256
4cf6cf9332fa0968348510b49c0aad8015f0ec4e8c8eb9f38eb8144b96668399

SHA512
a0fbcc978a37eb0e1e8fafdf512a5401bc136f008726de49aa1de6a019f6c800ed88756b89afdcee56bbf3c9358c5baabab0c6b948941425f5b0407f259c97b5

Download Submit
/data/data/com.yFWrHZpr.fjyaObQj/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
d83bb13cb16ba8109ca6023eda63d82e

SHA1
95fa40bc8365e91c7ffab96ab53510befc81ec6e

SHA256
5d52189ac052c6aed1927b0dc51f7dbf6b15a441298b4e6d365b51ffec4a053b

SHA512
8934dd402d46d9d174ea97d468627d4f5b7b328eb4a57bfea2a2a0b509a7286eb0d94437cac8c197610619dc2d9074488a438bc41f2f14cdea379dad603a3b6a

Download Submit
/data/user/0/com.yFWrHZpr.fjyaObQj/app_ded/J6QHpP3M3VpeP42sXWtgGMHZ0glBSZai.dex

Filesize
6.5MB

MD5
23e7d3eabfa943b967908956a41ad81a

SHA1
fbcddc18efb5657ac233f8b9be4d792831c2d84d

SHA256
0c680cb30aef5934d78f0bb006fde3a35a87187e0b5a3616a14cd4da6efe0517

SHA512
2cedb09f8e870d6f47f76d44875161ed8ea96f1555b1d7ae2b069694864b84d4f680690c8bbb11de9d046a5882335448f696ff31c42e2aa317c4da28d4d809e9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads