ermac | ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32

Analysis

max time kernel
147s
max time network
155s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
07-01-2025 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32.apk
Size

3.0MB
MD5

a3c3df62b04862454fa2cbb982c970ef
SHA1

71789c4596041d12429609ceae20c5e1cf255160
SHA256

ee3a894ab258df241c08a6167981bc273a9a6efbe4f58425fd7362703a0bac32
SHA512

64c3ecefbda27c1fa79d1fbd0e317b256ff86219381e64c175db4d09f1de9a5b7fb5dcbf801e30cd237b0883515f2a114210e38296aad131ef7467e068f34506
SSDEEP

98304:5AiiQ3V2iLfDOegg4TdPuh/N+HtVFqqyB4CVZt0:Xiyhq+oNn

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://194.33.191.252:3434

AES_key

Extracted

Family

hook

http://194.33.191.252:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4770-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pudewalamopa.yesiba/app_DynamicOptDex/xaydI.json	4770	com.pudewalamopa.yesiba

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pudewalamopa.yesiba
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pudewalamopa.yesiba
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.pudewalamopa.yesiba

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.pudewalamopa.yesiba

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.pudewalamopa.yesiba

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pudewalamopa.yesiba

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.pudewalamopa.yesiba

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.pudewalamopa.yesiba

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pudewalamopa.yesiba

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pudewalamopa.yesiba

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.pudewalamopa.yesiba

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.pudewalamopa.yesiba

com.pudewalamopa.yesiba
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4770

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.pudewalamopa.yesiba/app_DynamicOptDex/oat/xaydI.json.cur.prof

Filesize
2KB

MD5
6fcd625a7052a8605ad0e296390d2dc5

SHA1
d03a5173ee271bcf79a63855d94e8f014d3ce4c4

SHA256
d3757684d753ee4afb4a36c40e958691fbd9b302966ec15da22821c3f88b6d1c

SHA512
01f4116613e550f210ee6fa931c9b01904852a24ba438cc42d99c293fbb01e9724e563b2fc7c232363937fe9929a215b5619b228a98734de677271e5764990b6

Download Submit
/data/user/0/com.pudewalamopa.yesiba/app_DynamicOptDex/xaydI.json

Filesize
675KB

MD5
011dec3bec803341a063ed03f5036137

SHA1
f1eab122789f4059f8b65db83c4602b3b3ca481a

SHA256
39d1ded8ecdbd92bac4be34382fea8fc723872817bfe6d9c24645d572c5fcaa0

SHA512
e39cc472581aa156ed57e59c47d9899f92ad9256e91c6e7f54bc18a14ba4a295fcf8b61de6d1896b2f53ccf07703a7ef400dcd86ec8651ec732ab2cd5f045b3d

Download Submit
/data/user/0/com.pudewalamopa.yesiba/app_DynamicOptDex/xaydI.json

Filesize
675KB

MD5
fb152de28f5b856d545a63ceb04d699b

SHA1
fffbf8e3b9595bf8b0b2867103530fe02c73c3cc

SHA256
6affe13cb81ac771ad2bf9b0cf6ebf229e3a1033a84a23fd3b78256c296025fc

SHA512
7bda40036e3054c1473299898f026a94740b50d4a422181eed1f545d313722391057111120db889d373a4d36af23283fa06fa840a06ff83b92c1df74819094c6

Download Submit
/data/user/0/com.pudewalamopa.yesiba/app_DynamicOptDex/xaydI.json

Filesize
1.5MB

MD5
bfcb0472637aa44e8dbe366cfee28beb

SHA1
ba403155e2aad7a91a0bda471b87fb23da2862f5

SHA256
fa126c6ac279aaa1f3144d0ad088dad3f5859bf6cd5c34eba4cb5a0b592cc1a5

SHA512
3a815b3dfa1f5ce35d347673f902ef1e557c4ea4e2d2cae8940757539c868d3cf82475fa1c09782861b1f62c6021e3971a12c240845e86dfee836c9ca3dafac2

Download Submit
/data/user/0/com.pudewalamopa.yesiba/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/user/0/com.pudewalamopa.yesiba/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
6752fac2fa4ed76ded6de62305137271

SHA1
16059c8b6969fc20ec905681f607f1716ed557d7

SHA256
d5322afdd9ddd597321fdb3b334082ef75534a3f562fc07f4add03b059b4ed0c

SHA512
e4b666abd798932c978bc51f52e91861cecdd32d73645fd1dc6c5080283044b87af4937897ac870a4a2addcec084268d4dd97b8c748509929a03833c42c08f38

Download Submit
/data/user/0/com.pudewalamopa.yesiba/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/user/0/com.pudewalamopa.yesiba/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ccb1a7b7cfea72da458fa0010d1e8bf4

SHA1
8c97313a74c5bd5fe22eba0c954ed3291d085747

SHA256
0096c7da68530dd1bd6bb37c69ea684c9059f24dc4f9c7bbd3751350a487ebfc

SHA512
6f616837c6919a9442fffe18145f7b10cee294350b84d24389d8dff89f6861e1f3ee600ebf0f6d6e7deb4ee7fac6ca88705e1ad4fffd2f6ecf5da0d3843bed88

Download Submit
/data/user/0/com.pudewalamopa.yesiba/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
476ef7ef887058a0432a4f72fd483ca5

SHA1
654e1e7cf9f81a93840e29809de21e6addc9cc67

SHA256
35307e9d26322980a348ee5fcc5016cc2c5cd55278e4534b599ce34da45140ca

SHA512
118cd0b780bbde53e3ebec7258c724df5e44e8d5eb3e9fad5b1b9808b00196968d7fcbfba0c30f540c85ac2b0a66f1032e949e89c11757a79daf9d30c5f57c8a

Download Submit
/data/user/0/com.pudewalamopa.yesiba/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
c23b647880be5ccc1b75c87a57098ba8

SHA1
2455b9cecc5f0c20d7cc463231b0c4560bdd380a

SHA256
8c7cc77abf6b815630f53bd2153ea92cd366e8fcc48c2654de8003a8c9802b76

SHA512
f5843f42cac018ad580b8a6469173c916cc5d46d4304477d91f34300da3cb510e76e7a2883f90a2ff28bdb7088d739e08245e7517e6a5c3224c08f1481e17604

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads