ermac | 4b807adf64b0928dde464851b11ba1d8fe9b09ed6590f0d407a743e4bef2a704

General

Target

4b807adf64b0928dde464851b11ba1d8fe9b09ed6590f0d407a743e4bef2a704.apk
Size

1.4MB
MD5

4eeefae90ae2b2e32da24cbcf1eef056
SHA1

5c25136ac3e5cb2f94cb65beda2d0906a10b1264
SHA256

4b807adf64b0928dde464851b11ba1d8fe9b09ed6590f0d407a743e4bef2a704
SHA512

843282ae5af99ae750113f10062d6767b7e6a3b7cd7a3d8424e633855dceb15023c6fc1a6bc88e8c32bea5c36e00a5276c550055d73d72b962eaf80901d37b99
SSDEEP

24576:eM0Bb9zsil6DUOecV8Ads2TnfvI+jp3VWm4SpOKTRHZN/rBNF3:z0BZzs2JMyAW2D3I+ZVUK1HbjBn3

Score

10^/10

ermac hook banker collection discovery evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_ermac2
behavioral1/memory/4230-1.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Makes use of the framework's Accessibility service 2 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.ranixebovura.delasawa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.ranixebovura.delasawa
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.ranixebovura.delasawa

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex	4230	com.ranixebovura.delasawa
/data/user/0/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex	4301	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ranixebovura.delasawa/app_ded/oat/x86/JBZAU80gbJP5PwoucwaH7teta85RQPgn.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex	4230	com.ranixebovura.delasawa

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.ranixebovura.delasawa

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.ranixebovura.delasawa

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ranixebovura.delasawa

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ranixebovura.delasawa

com.ranixebovura.delasawa
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4230
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.ranixebovura.delasawa/app_ded/oat/x86/JBZAU80gbJP5PwoucwaH7teta85RQPgn.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4301

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Foreground Persistence

Input Injection

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex

Filesize
1.5MB

MD5
250d18da3217ab6834f91d6b1c54b6ae

SHA1
b6c5dd301255aca91d76b7e3efb56e5153fe1e2f

SHA256
e9022588d05e2ca8087a7a359b6aba55fb3456221360e6dd821d25aa79adb63a

SHA512
baf5ea8050294285d81a39de61de36cf5a406cea41122e2794354341742e7a5223b276767180a15833eacb27ce677d8dfb36d18dff8f77dfccd1cfbf0c2d61b5

Download Submit
/data/data/com.ranixebovura.delasawa/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.ranixebovura.delasawa/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
f00434c70d521230c8199f338333e8eb

SHA1
de72c6faaa0bda659523b78d1c788ad901a81abd

SHA256
289dfc438735a80d692c945217e0e7fe4c37e6d549f5a65baf11975fa63cdb95

SHA512
619133c051e856e429ff989ebb8165a2eb3c496ca0e92eb1f943b56f75bf504d1e274e35a35b5db59611e5d86753da97ba9d6ac92d238ff9a26450cfe09e3116

Download Submit
/data/data/com.ranixebovura.delasawa/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
a4fdaaa4bc6bc3aeff51cfdb667b5e96

SHA1
88f398f363b20514014b09c599901bb4b792e63f

SHA256
0ded73aa5cdb1852073e58b5fae98782d1a0cc1703c967c04521715fd4b43019

SHA512
3109d49a86d40727a989e7dbd87715a426c043e59f7f20573e395bee2a4d54e1ccc92b1a1dbb7c4060f19101951e54e1c1555c35d23787a653262be7d5522739

Download Submit
/data/data/com.ranixebovura.delasawa/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
447f39382b180a8f25c8b7d3b6dfb6f0

SHA1
835e597f21cefdc123ce965b2e9c643985515058

SHA256
f6ec16678aa416657828fc89332735c1b7acc8e43d45cd05acc73e2d6387d4c8

SHA512
704d56e18eb9f1eddde27acc5a848f4af1bd49935d2a2337bea4ca01b06151feca5917f71b1812f2e39163ed40d7612b572a7d2d4e9b7e958e14ca448a9a5eae

Download Submit
/data/data/com.ranixebovura.delasawa/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
8c4eaf4da519f3ec799ed67eeea39e0b

SHA1
a817926184bd8375155268658e7c79496a0809e7

SHA256
9893c9590f4bf2da85388efaefea0268c557851f51594580f782e81e60b6e7ff

SHA512
c7a00499254752b784b023dc95122da7882c11253881169e6125eb3bf28ad0808cd737d86fead661410d458e05788aefee10689f9a0a8934cba7c97b03a7abdf

Download Submit
/data/user/0/com.ranixebovura.delasawa/app_ded/JBZAU80gbJP5PwoucwaH7teta85RQPgn.dex

Filesize
1.5MB

MD5
a558dd964dde892087e4490d62657fab

SHA1
8f63d4254722aa3995f05f7fa91a628ddfbbfe11

SHA256
211cbd56b1c4abf9499e06b7dc29beceb8c44b65408dd2193ee322a0f870dcf7

SHA512
0f116336241e1e18cb9a765303b72eee1e38058826aa83fab06f2bdeed9d208e11c8ebca7e02f0665ec8283617489dfd206ee8e5910ab7682d59c3b87a6d2b3e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads