Overview

overview

10

Static

static

6

00bf4f784c...d3.apk

android-9-x86

10

00bf4f784c...d3.apk

android-10-x64

10

00bf4f784c...d3.apk

android-11-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    19/03/2025, 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    00bf4f784cc5100cc2377d7645e71542607918d3399329a4b634d8eeea0fe1d3.apk

  • Size

    1.2MB

  • MD5

    0ee2c9a8d23c128f8b728d9dca61b353

  • SHA1

    8519a49f458cbf6ddf2c6cd1c877d42e2f832c93

  • SHA256

    00bf4f784cc5100cc2377d7645e71542607918d3399329a4b634d8eeea0fe1d3

  • SHA512

    8e4cab6252fd5f2193769caec6e3f1df502d54f12812f999a53593453d4d1548948c568900b3fc532923b98ecf4360ec29f27b52fe0ffac35057c2e1e2a36d14

  • SSDEEP

    24576:Ar5AcJOBLtAUqvblXWkQb7027QFv12GQAq6DVungSseWKU/kfKc:A91sLNqRX5QH020BoNIDYgSgfYX

Score
10/10
ermacbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Extracted

Family

ermac

C2

http://194.26.135.189

AES_key
AES_key

Signatures

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac
  • Ermac family
    ermac
  • Ermac2 payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 18 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 11 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • m36uk1.nhhxx.nn4zuj7
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4265
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/0.pobfs --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/oat/x86/0.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4292
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/1.pobfs --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/oat/x86/1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4314
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/2.pobfs --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/oat/x86/2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4336
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/3.pobfs --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/oat/x86/3.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4358
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/4.pobfs --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/oat/x86/4.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4381
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/5.pobfs --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/oat/x86/5.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4403

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

3
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/0.pobfs
    Filesize

    134KB

    MD5

    930848d8b36b9bdda307a0b651e0f6d4

    SHA1

    09fd7fc06733276012deee9d5527f579fc41c1c9

    SHA256

    c09106228c280448690dc91430d5827e0c2f0838660e127bd1f25ec8fc323e29

    SHA512

    09ad1ac9f8a20872935fecb523a8d744dd1deac638caea0976bc1bd3fe576fcf54ee36ede59180c3930c6668aac8cdab059fd91636c4e581ee5d4be87add14ba

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/1.pobfs
    Filesize

    126KB

    MD5

    60fc19b58d8b451b41f9bdcbd1f0ca67

    SHA1

    89b895677e11e96f97801ff498a6be8f302c71b7

    SHA256

    10c205629a03266ea7b28c73151551e19a9aeeefa8079dfe78781e370ec90c77

    SHA512

    c7556f00df13a906f3b4941b9205586bebccd74cbd77818f302ba7f2e87607ed8ff5c04b61eb5589ec98d79e3f2f196cb7140000873ee7db59d18ca0f246f1d8

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/2.pobfs
    Filesize

    30KB

    MD5

    73b5595e570f7a22f92de49e466d3c40

    SHA1

    b24ad99990ef61c2eee73b9ceb60edbba65cd621

    SHA256

    3fe3ce420c34ea08f30f9a844d9bed71a45899f24d960a8d6bdf57f0ca13c39e

    SHA512

    f8b2c6764ba0f777a28d3a0d5402d1bea4f3926bd8f88a61326848c201e74a5c7af84072029f915c2e474cc98ebc7b2567c4c3477fe98e27c74cfa141e161b1f

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/3.pobfs
    Filesize

    1KB

    MD5

    06a867a8f319bebf08c01fe618672a73

    SHA1

    5d5bace760d92bc1c048bcd2cacfcd30e310e0c6

    SHA256

    fe25a21e8d232b3ba461a6fdfa6dda70b61ac5cecec200be9b4b0ec53408a49b

    SHA512

    0700395a92b4e862ac557a9c7deee98f27d5af262a42d87c48314927edc2dc1d2c0603b2248101cb5e67ab0c2328dd277a23986fd5bb086000c686cb837863ee

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/4.pobfs
    Filesize

    3KB

    MD5

    236814b3bbe6c9a512fc7526256d799f

    SHA1

    5e9b1288c56678581f52e70cc2975ee05040e450

    SHA256

    d23813e047b8d088b935872fc55ccbdf0f2cd2676d3ae6568236119c8b2b71ae

    SHA512

    0e631664050a635bffcb02fb9c7993f572b3d7a9862f01ef7adf005df9da62efac789299028e07d333aa27196ab2e59ffd993f3083e18e8b559aef9267c4fc31

    Download Submit

  • /data/data/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/5.pobfs
    Filesize

    541KB

    MD5

    a0a0f176952e3d88c73ea49b8eb82dab

    SHA1

    7402683535b9365fe4b449f02f3f257f88c11006

    SHA256

    baf2de6faff8af304f869a25f5d9af7e8583fd7f6f90a744805c65818b7b2a18

    SHA512

    bdda0f180ecd132cafa28baf81be6100edeeb76b70daa42cce8f250c3a3e387c3c49ee2e22da96be6130560eb2599c9ab9215ea3d7419bd3bbb8dbe9ce696109

    Download Submit

  • /data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/0.pobfs
    Filesize

    134KB

    MD5

    25a08ec09f09e924598553ee184007de

    SHA1

    164d530894aba16b23302f8369664c127045f222

    SHA256

    811df578620b4f3521f3d08ba5aa1f698277546856c2934022a90afb4a82c0db

    SHA512

    b854a8d379541ab898bab2488de92446c0c2fe8b9d751740d777da9231e380153e16f92103891d3a69f727bcc50497b13864e7b6fb7ae0d7790cc59a779b58da

    Download Submit

  • /data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/1.pobfs
    Filesize

    126KB

    MD5

    bd654830de71be837545aa4a1c0f2873

    SHA1

    770bccd3b71e4d4fb7497a01ba94677acf1956f9

    SHA256

    c17420b485655c77e4558d3deef7a0be306f8f7fa5d35c3738d17a9acce7c4ba

    SHA512

    6fe3c1b9f0c427c57cd109684a59c04479a85dd77cf51dc90971a715b4a711820e349f04acefd0f0bf892fc20740c0f9efe04c9f8d8641cfd94e48ea44d88093

    Download Submit

  • /data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/2.pobfs
    Filesize

    30KB

    MD5

    4d02dfd03f0f7b93f7dc4317e3e7f712

    SHA1

    ceed015109fb45521767dc7baa2e613b72ee322d

    SHA256

    8cdf46a5fbb66a6b88f32653e68ea8db0f30a47e24a58d8055e8538ec216b5d7

    SHA512

    fc1dee20cd9e789afdb40018955060a07a44bf401a290d8d5ac35d602d7f2634cc113b9927a67a93736acc686b4a7d0ef9fd2a572c4520740fdfd209b7df0afd

    Download Submit

  • /data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/3.pobfs
    Filesize

    1KB

    MD5

    faf7076a8bd54f10850253e6f44f4fda

    SHA1

    2426e94401f30642fa0576df698e1c3deb225092

    SHA256

    c9580dced8ec33e6191d0f1ce8c8effebbd5a50dbeb02fa923406a708bb03e52

    SHA512

    f41678c6e53bda0b3148b456fa383bf92be242a6ac6b756339f1e218327e067d10aacb22f75735771ace12d7d6bbebecf823889ec84be9fa49ac2e2aa7f9fec2

    Download Submit

  • /data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/4.pobfs
    Filesize

    3KB

    MD5

    d366e1ebdde23f863f318c9126446f53

    SHA1

    7817b44f0fe17954a24affebb602178936055ce6

    SHA256

    82c918a4d36734ee7b9ab3f58bd355810a8ce0e2fd9a02201976fb98c9368354

    SHA512

    6b3594416200dbbaabe8b84b4ead71a81b80a04a52f14e5a12aa43080af405c91bec0927ac00ad5bbe0ee4f5419095996add57b3d1e2884c067e14ab31f28878

    Download Submit

  • /data/user/0/m36uk1.nhhxx.nn4zuj7/app_g3tg.d45.rvd4.b6a/newobfs/5.pobfs
    Filesize

    541KB

    MD5

    0add7b6a628b9c25b905b7688138a845

    SHA1

    b903dd4d6530410d13db7a9daf58b963faf3d109

    SHA256

    5c44f3d3ded68a5e3422f991ce55beda5e9e83fa69d0599d9f6b9f53ca0b3683

    SHA512

    8dc41152a2cf1242c2f410f9bed4afd7bfb4381e553b6ae1e3d8a9026f260f08595210ac1790d0d452a0dc2e56c67da2712fc68d55a8e3deb53abd61c61402ef

    Download Submit