ermac | f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a

General

Target

f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a.apk
Size

2.8MB
MD5

0d938686bf6169169e6aa678f9f95154
SHA1

fb690af0a6bd7ce46e08096bcafe366123cf0a3a
SHA256

f1ba0a022c9efd97840a6dd2853fd907393ea13a4200512f062aa6de7b4e514a
SHA512

d25b4a40be79bd86eb5547e8170efb041eac0e7aa92185ebefccfead83e193e5c8073b2a2ccb4fcf43ad0b3894369a3fd1e380428204440f2b8e321ae3ce8278
SSDEEP

49152:g86XQt6FU+E2O3B1My9jLwGMog8rRgaTTyXqyCFHnrN/lGojtDmIAOzt4:g7k6FhE2OTxCgRLTy6FnrJlxZmpOZ4

Score

10^/10

ermac hook banker collection discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

ermac

C2

http://91.215.85.37:3434

AES_key

Extracted

Family

hook

C2

http://91.215.85.37:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4590-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hanafehozevu.rigilacu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hanafehozevu.rigilacu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hanafehozevu.rigilacu

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json	4590	com.hanafehozevu.rigilacu
[anon:dalvik-classes.dex extracted in memory from /data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json]	4590	com.hanafehozevu.rigilacu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hanafehozevu.rigilacu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hanafehozevu.rigilacu

com.hanafehozevu.rigilacu
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4590

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Input Injection

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
674KB

MD5
2766071bd26a34a56af8bfbfd823809d

SHA1
60f8683dc0a9fc77007edc863960104ace3e8462

SHA256
c431ade2814e21ed95d7d6047bdd241ff96e7780a2c50547c8e2870cce9bfc5a

SHA512
457ed1972dd5325efb306b433408478c04cc6fe30c65b01c970750bc57e59f50ac9760eb06c55ee7391cd701019dc232d7f100a9dacfcb88445f86c8c9a732bc

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
674KB

MD5
cc07c2243fa78f1555f531c29094a17c

SHA1
e3dc6283baccc7b511117cb56893019b91fb4c22

SHA256
23e661a06d4c5bd456e4710519662d32d80e4ab6d8046a9787b1efac539cea85

SHA512
f451f9d5cf3ef64a05286aa6da04431e30ef37d2cc0e0544f1f5c7c3c50e4727c8c06c92a72e607c6b521c3f3a100d946b7c192721ddd87c4d8c46a139d5a492

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/app_DynamicOptDex/XdaeO.json

Filesize
1.5MB

MD5
97c94f30ef4fd62b945b883ff3457fc7

SHA1
7d8ef97ba034ac7caa899bac1c5d84afb89ce605

SHA256
cb023cad19cd1e2d48eb13afbdd31b4fee2bd5514305b32f8e753333dc9d28d2

SHA512
63db09bbd1b60066a07e625dc67872d5241c8c24baa989f731dca13c1f8187ca34cf6a698a83a5618e47a8a15c5a14d48c986ca33b9ab69223947105e46fb684

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
dee7fcad566722d3b1d9e23b441c38d8

SHA1
0d9dad2641f73ba85d7e4ce8926987769fff13fd

SHA256
da5f7e511f0e18a7ab4e5b1605318d5cccfb2ade2e0ae73431139bef71ef6a92

SHA512
f02b72e2e7f1b4a73c114cf4fb2666867d9a1a3b56ee230999113e50d510016bb29126120f84249213ebd5e064eb1214ee97902f04451a28e39b29d6f2f74ed4

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d9b6dfa23c3932afcb19c15d6bc7e6ab

SHA1
9be122cd52c4d050b8a7d69d80a4c37ff41c20ad

SHA256
db3b42595847ead03bb236a370888a376ed306b8b7ded23df0e705eec61b1ad7

SHA512
7fe467853747e6b56d906c33058e8a3f8866efc825842f501eb6b0766b77f06a38c84b6a8c6310f12bdc56dc3cb9568ba6003d8ba984d79e9a83ab0da3974847

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
13cd5f2f65cddf5402f25b0ee087a959

SHA1
39afbd64d388346391152b872f326249334897be

SHA256
98ed53c862fd3a132fd6066930065878f03fe4a2059800a819e0c985c5ba438e

SHA512
c8fe51b66fadeaf25785a0fb39d1d0dbd3e0571cd16a827108210c63376f806bbe7ed9f9b821c8a47d7dafb0399890570be35bfc9ae5e1984077050e5f2e5444

Download Submit
/data/user/0/com.hanafehozevu.rigilacu/no_backup/androidx.work.workdb-wal

Filesize
128KB

MD5
6ac3d5cefe34152facf5e3574b5f0973

SHA1
75de7a56699451ba37e8e4d598f7fe6320aa32dc

SHA256
f76001360b822443bd24a4889aa522b724710e3de2f7b347c0cbc8c523e92a4d

SHA512
8a2b660adf2386c983b06db09fdd2dd57deb646eb5eebf2a01715559cd3196e114e0e7cf351aa05b8dc4c345b50161ffa02824a58005a18b9d7126ae7409c1f7

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads