ermac | 94f37895cac3eaa479d0456edf771880a218395295bdba2a63f1b5b6d1e151e2

Analysis

max time kernel
66s
max time network
155s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
07/04/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94f37895cac3eaa479d0456edf771880a218395295bdba2a63f1b5b6d1e151e2.apk
Size

3.0MB
MD5

ed0a3ad1a076c6653ec30e416ced477e
SHA1

d1ad5ba04291fbe7f34ab8c3e09d8da1c2749865
SHA256

94f37895cac3eaa479d0456edf771880a218395295bdba2a63f1b5b6d1e151e2
SHA512

4e9129e6472748a4d0bc8c8a234315c67b91a64db7de237338c1d1f123ccb89eaefd65717baace8a5b2ad8bd5b6594f61d4a2340d18c9f26076d60a5bc574b14
SSDEEP

49152:7qHZQbWBhjXbQnxdFkqT1cY+5IWfYBoePOVY6ANw6aES6pFU2t7j29HGFZq5tZbi:KeWBhLbQxdiqhd+5eomOrjWS6N7j29H8

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

AES_key

Extracted

Family

hook

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4243-0.dex	family_ermac2
behavioral1/memory/4217-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.mm/app_DynamicOptDex/wP.json	4243	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/wP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/wP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.mm/app_DynamicOptDex/wP.json	4217	com.tencent.mm

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.tencent.mm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.tencent.mm

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tencent.mm

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tencent.mm

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tencent.mm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tencent.mm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tencent.mm

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.mm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.tencent.mm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.mm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tencent.mm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.tencent.mm

com.tencent.mm
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4217
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.mm/app_DynamicOptDex/wP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.tencent.mm/app_DynamicOptDex/oat/x86/wP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4243

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tencent.mm/app_DynamicOptDex/oat/wP.json.cur.prof

Filesize
3KB

MD5
a6391ccdc6cd2fba5d4e8f34a2b4bd92

SHA1
208dca6be4a6bfc792534750a92bbc9a773e5d8d

SHA256
8fb259134f3a0a0e28fb1118c9f0ffef19ea600ca61e23c1fa001ad232b8f2ac

SHA512
1b3fa0ee3dc65afee0e2c487d32404defa7d1aa707dbacff056e7af8c21b4445e77e02604d8c50f6adc5339d9278f8b1df42062ca57d3b7e5a623c278d95f12c

Download Submit
/data/data/com.tencent.mm/app_DynamicOptDex/wP.json

Filesize
703KB

MD5
ab63af32dced692d4d0a3ef38096ab44

SHA1
09d994db997290b1b25f43e601d048100cc25162

SHA256
e371b650390343fc07b0fe80884abba5af0a3302ac8a2df480d9634c86a6450b

SHA512
f96ab5c738243af7f2bb3ebb2bad5435e633e5c274916b3af4fbde431a68d48e5623f5a2ddbeeed12908bf8a4b349ab5aa15c9dbaeb026d71c97959e296febaf

Download Submit
/data/data/com.tencent.mm/app_DynamicOptDex/wP.json

Filesize
703KB

MD5
661296a223f204225d1041cec0d0d514

SHA1
2365ccb95e12d4f53a4474a3831bd9ca400bf254

SHA256
57df2add18137be2a7f9a7ec28cee249f6871873d8c1bab9f484d56dd26a4a7b

SHA512
636cce83a873aa2cb0fa6cfd8e7c2a7bb8259688f857be0e76dc5504909275971777520ae603cca5a6fadb01e3702fb4bae100b3d733031a7c8db1c6c7388f8f

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cff6d7e9a38cb8ff0a3305bf8c3e727f

SHA1
41914e4bb5eee64337ef544dea51ed6cb582ddf5

SHA256
3aa86f544ab84613cb1a2af1f36d6c64904b85655317ede7141558b409b105f2

SHA512
482567a69a0087041b6bb2ac0cb3b0274bb1d0d945812a536f136aead454d040814acacb8576b6630f2621b122346c233dbb9e8b9f261127bc48319056749079

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
df9eaf3a73af456a8d919a4c4fb0e97f

SHA1
7f47fa8d3c229d8c48a5a717f5e2ee61a363bae5

SHA256
9cb7bf19a8a69e02994486bfa4eb1235058a5d1d0a84318f7b7112c829591ca2

SHA512
7a8cd50d914b86e73230e08e47a6e0d33ac0b254d80c2d8750cb6d1cf64fe4773540b56e0b1eea932636d0e5211cbfb65e779bd39903f87f4fc9612d790473c1

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
31fbf37e3dd5f889a71ad94349b1f137

SHA1
4edd3cb8473705ddaceecc73d68dfd8039182001

SHA256
ad5e50f3d1dc1895e316c2822564690c7c8b03976ad0643f24f647c4cec89678

SHA512
384be5e304510574c24e525129c01caa3f2d7ab260fd9c648bdd29a560a5ece1f327911ce7b5a1b7f9fb601b6c30aa04b7fa91f0def279d34510bd84e20c37f9

Download Submit
/data/data/com.tencent.mm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
42a8fc720ed1156a6e169f925ad6be41

SHA1
c0fc000a47e4d8b72b57ff68e5959c6432901cda

SHA256
207b19fb5837ec1e469d76225e68b6b8785da67aa5be9bb72bc0752148d2b497

SHA512
b15da37e103a200ac96201896d495c491056bb70fc250caf30b4fbdd8455fff92a536cf061b0f00f2e9578555d037946c6aedcb32df677a7d79f75a3e938d9b6

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/wP.json

Filesize
1.5MB

MD5
95767193b8b25dfc70f6812c3bd48b8f

SHA1
1cdffcfd09fda484b0212865b8feca7c5901e815

SHA256
0ca210ac5d2ed3bc9d4f230e215352c11dc7a9437c3b158c7ffb39d770c02760

SHA512
660807dda80475a4f477b13cbfb31127df88df7dba4d870ac44c5c307c01ebb294b424cf8a2eb0ffa51fd826079e7dba9f65485c4c344d2b282afcdbc7fc9f33

Download Submit
/data/user/0/com.tencent.mm/app_DynamicOptDex/wP.json

Filesize
1.5MB

MD5
2ed7fe2320b0bbc4d75b899f28c6c918

SHA1
fda0b763ac36fc014568d3ee29e424343b75278b

SHA256
0d448c1c4915a9ab1b94c1d8757ec4ee09a5973bf4e2e1661a9ec65e673b7b38

SHA512
43a9c85e3f127caea4a448ab08342cb041e29e5087473dd733e59285a75bf518f7358c5ea1f4c910ce75d637df321968979c1c8e69a2417b1278191d38f2279b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads