ermac | 1e2950368a24eb74fbf4ae1fe070b009a3123e7821681a67058b92f03b058046

Analysis

max time kernel
2s
max time network
175s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
19/03/2025, 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e2950368a24eb74fbf4ae1fe070b009a3123e7821681a67058b92f03b058046.apk
Size

1.6MB
MD5

276cd63100ccbb6444c38699c3a80269
SHA1

e5a7723ceb027b0b429c65104d4cc16fcec16731
SHA256

1e2950368a24eb74fbf4ae1fe070b009a3123e7821681a67058b92f03b058046
SHA512

5e1c586b139a264efd889d0b6e289272690dbfae2d66c1a7f9b6d73c0297f90c022d166313be60c7d44668802bdceb8f57cf65bc00c11c8e835602f1c4789f06
SSDEEP

24576:blkMBm5zFdKJy2zpSacoH0jDIaDsG/mD0NH4LKFPgIWRjKmxRGVImgS76:blkKOdczpScxaDsG/myHzdXWRjaV/gSO

Score

10^/10

ermac banker evasion infostealer trojan

Malware Config

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral1/memory/4213-0.dex	family_ermac2

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xc7275000-0xc747fe90	4213	com.wofakiradesa.buvehu

com.wofakiradesa.buvehu
1⤵
- Loads dropped Dex/Jar
PID:4213

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wofakiradesa.buvehu/.google/libgooglev1.so

Filesize
314KB

MD5
0697d041afd8f5e6101235ea8bb2e0ee

SHA1
d2fd74bc613c0bbb66ed006ac7f8714a47733b8d

SHA256
e42828f8959a3a4bdd35305bfc6e018ede8bcdcd48d75f2056831341a40b5da9

SHA512
2c53992f7ba7ffdfae7ff44ce56cc2249db0991d1b0337312b79fbb9dd5984a216901d2a0936b4f9e8cd9039129500afe67e1f9cfba7abf652cd4c3b1fae5500

Download Submit
Anonymous-DexFile@0xc7275000-0xc747fe90

Filesize
2.0MB

MD5
f2600a991c54a57cdefc97bd3ec30978

SHA1
b29ce9412b3d43eb3d1e7ea82c3b09d1bd44e3cc

SHA256
5e0d3db6e42bb0553edd569541c180f55c3e9af6f25943f09b7b41664d02d588

SHA512
690b5d335172aacca0f84d1a2517c474579b6ee6e66125bc013c0815ad07334b8f8646648e7448337970cc87f7fe3e6d7ae9deb209cd5ac4d81f33b266f00ff1

Download Submit