ermac | dcc65f578fb635be7eabc054d7a34d5fc7c8e089d4b04d99e8376c99bbdc96d4

Analysis

max time kernel
13s
max time network
149s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
25-02-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcc65f578fb635be7eabc054d7a34d5fc7c8e089d4b04d99e8376c99bbdc96d4.apk
Size

1002KB
MD5

d93d606967a9022309a48d11f24e90e8
SHA1

2420298b831dd48ba0edbefa98ead27cbb6d0fb0
SHA256

dcc65f578fb635be7eabc054d7a34d5fc7c8e089d4b04d99e8376c99bbdc96d4
SHA512

392a05c713763b0310b6b7babd2731c1b26dffd45f1ea399541ee30dcf759e1f94c5c820264e6027202bee870b649f87c2dd8b54a4511b0c504187407df30047
SSDEEP

24576:0A8I2eBvyQnP5v6oFk/h4ffa/pUnZBG5d89d8nd80d8Ed8Vd8ad8Fd8kd8Bd8oah:E1gyk5vJ44fkxh

Score

10^/10

ermac banker discovery infostealer trojan

Malware Config

Extracted

Family

ermac

http://20.0.144.123:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	nusku.ermacv2.apk

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	nusku.ermacv2.apk

nusku.ermacv2.apk
1⤵
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5087

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads