ermac | 4276d1649764516e99b72407e57d45e9cf533c54a1b244c0e31a0cb8282ee1c1

Analysis

max time kernel
145s
max time network
155s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
06/03/2025, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4276d1649764516e99b72407e57d45e9cf533c54a1b244c0e31a0cb8282ee1c1.apk
Size

2.5MB
MD5

cc7de0255e16e361c0f34130239b6a62
SHA1

82d69aae36cedbb589138665659777198e2bfaf2
SHA256

4276d1649764516e99b72407e57d45e9cf533c54a1b244c0e31a0cb8282ee1c1
SHA512

71b5f4a60fe2bffbd45e5fe1399ee91e14d3f3d363c0674595e8d67b527a0a4bfc59d68d1e1f69b5d61659dea801aa773b0a4ed7f46f7726a5ea804ca0d0ca2a
SSDEEP

49152:sl6Q5bjxjfdPxZzqVvqH6pUvtcbW2IgsYDRLJB2A2+XW3fJmD:sDBjfdjqVni1cbW2IgsURz2+XufE

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://85.209.176.78

AES_key

Extracted

Family

hook

http://85.209.176.78

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4301-0.dex	family_ermac2
behavioral1/memory/4275-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json	4301	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/oat/x86/bQGZA.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json	4275	com.varecobexicemaba.heribivu

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.varecobexicemaba.heribivu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.varecobexicemaba.heribivu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.varecobexicemaba.heribivu

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.varecobexicemaba.heribivu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.varecobexicemaba.heribivu

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.varecobexicemaba.heribivu

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.varecobexicemaba.heribivu

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.varecobexicemaba.heribivu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.varecobexicemaba.heribivu

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.varecobexicemaba.heribivu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.varecobexicemaba.heribivu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.varecobexicemaba.heribivu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.varecobexicemaba.heribivu

com.varecobexicemaba.heribivu
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4275
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/oat/x86/bQGZA.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4301

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json

Filesize
687KB

MD5
23119440dbc25974466a0e3a7f43aefa

SHA1
f5a368299b88214b42eacfe21f31dd52c0a45fb6

SHA256
ea432adfa255100a4bbf96cbb2a71a0deaa854c3d376bf7416613f992a228ed8

SHA512
3293c293be3a7e5dab5c6a34a806752c29bdc662300ac457d6670bdc3ddd96de2faaf93a27854325943f4233549e9cfe910ac3e42d1d84e17bb5121190b2830f

Download Submit
/data/data/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json

Filesize
687KB

MD5
76441a57dde838b124cd086312dca3be

SHA1
a103126bfdea9ecd0585e32f87f2bb6f249f2059

SHA256
915c50fe6ade43e23078a821c5114d1485088b230a8c523e51488cd3fca9da11

SHA512
d1796ed87e02dab285d915edcb302e60e415f9a982047fd0c83990841c0cb0bfe1f4bd22aa2fbc2218292a162d76bc916c520acbcf1ba2b63a2a19e3406f6ea8

Download Submit
/data/data/com.varecobexicemaba.heribivu/app_DynamicOptDex/oat/bQGZA.json.cur.prof

Filesize
3KB

MD5
e950f06ee08cd1a7daed8a5a686786c3

SHA1
efb2c3dd80637b533b94fec35a6952f9843c7417

SHA256
76edcfe0611131ec621c16c3c150e10462783b795bd176b520edfa6a3f432828

SHA512
78cc4a56c12b06368d7f62c34822a30669047563ac6e6b3bb8062d4e2b8e01706962ab5cc408b91def059e51986c2900b671533e63f805e266e61055ab210426

Download Submit
/data/data/com.varecobexicemaba.heribivu/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.varecobexicemaba.heribivu/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
d26f35af82a3e6b84ace7e05990e516a

SHA1
f64684591da0238d66e51c628f7c48144b946f64

SHA256
254e707b7101be774c72187efff17feda3ec7d5f140e8fe18d0523f34edeb612

SHA512
78905d7833dee17f489ebfbca7c7a08421daa8ce9720c54b3cfc7ad2778277f89f3d6812f19228aceadc22007a3d363e03e6ac7410e307086eeac05dbbd1a748

Download Submit
/data/data/com.varecobexicemaba.heribivu/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.varecobexicemaba.heribivu/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0c585307293f5f63c115951971a194c9

SHA1
1f3965d8bf03632ba7e784d970be370708fda08e

SHA256
388a87ebac2f2cb2f25ea43409c269d68c70f6cdd24d56c7ac0e9c29a45e29fe

SHA512
5a39805d73e433d5358e2c761406002daa6f1672936b4b96767077b76021b7b7cf80b56ba8e45f59520f25d5a1237fe8685878fad65f9340058fad12239ec91e

Download Submit
/data/data/com.varecobexicemaba.heribivu/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
577e69096ae2b99e289ed7c4ec0d0e8c

SHA1
c77d490c3d4be4216cf449890bf396a8ca3578f5

SHA256
3ba5189d12d5eb25f777c24d7d72a4972e7518e836a92c53b40b6d6f32590f5d

SHA512
2f8386667e4c30353776f4881e787d63d6b3113719e8376dd9ea3b2d1db5d981400bf61511b853cef9463c6cb759408b497720cf6820b7bab00ad18197f424b9

Download Submit
/data/data/com.varecobexicemaba.heribivu/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
245edad4bad7ff0e88351b6f0df0051f

SHA1
f4c05cf6151656779304591d6077692b643f367b

SHA256
cb8f161a8b523e1703ae83d07a40e34700ad5204b1192bbb018104e9fc4af26c

SHA512
584335ff40cf96af6ec7495f2ce46056bd96cb7a3a4e257b0cf5da482405382b8d8173cefe178cee4b53e7326ff5fdfb7c21c1b5d8d95ad5c4870137daadff81

Download Submit
/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json

Filesize
1.5MB

MD5
aa1ac8f3a0d83d7b3fc701412996ca1b

SHA1
59a1f873b83794a2135bf286a1c65b3300b01bfc

SHA256
11c767ede99cdce18d0b0718bba08b65afb0f78a073758e892eb5520252af587

SHA512
e9c89f0e2554a907762a8bae1ef2c01b7bb9cb03ba2b65514365aa20886aca595fb78751e2c2572d154b2d119db28c2fce593c20c064f6ee19f100a1d97a2353

Download Submit
/data/user/0/com.varecobexicemaba.heribivu/app_DynamicOptDex/bQGZA.json

Filesize
1.5MB

MD5
3192cb0f42670743bb88136374b8d97c

SHA1
1e39f090d8c5cd6927f5ab016b99638569e81f55

SHA256
dbc4186f7507e930176339749805b95e07c7834341f853906c30f88d90a188d0

SHA512
8890176882ced6d9fec884d95547778199030dcee7c9ede99d070ac343bf2f10b5073b53fe4e2b5baadacee94557310d5a134b61b858e352152e8916471625c9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads