ermac | 889adceea7630db51ec63440a9d06f8309fb1568c556d2d60f47cbc02da8fb96

Analysis

max time kernel
149s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
13/04/2025, 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

889adceea7630db51ec63440a9d06f8309fb1568c556d2d60f47cbc02da8fb96.apk
Size

2.1MB
MD5

5b4ce4c84ad6cb33cbd232d606f39e22
SHA1

cb14ac2d3efadac5d3bbab1e54988bd32f81bc87
SHA256

889adceea7630db51ec63440a9d06f8309fb1568c556d2d60f47cbc02da8fb96
SHA512

b2d805f7201dda9a188448664497b5942cc862afe8fac9342462a544de4064dda1cd4287988d36aafa0545eba11ddf83ec59817e7e9abc7d83a8026c64233080
SSDEEP

49152:F//smWXDb9dPa8Peyl19AGfSprrz6vv+SiOrgR70S51BZY:5/sm2H9dyc/9HSprrz6H9bS51LY

Score

10^/10

ermac hook banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://154.216.19.93

AES_key

Extracted

Family

hook

http://154.216.19.93

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4436-0.dex	family_ermac2
behavioral1/memory/4365-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json	4436	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/oat/x86/qimuMe.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json	4365	com.kararamakarahfgsac.mararadk

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kararamakarahfgsac.mararadk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.kararamakarahfgsac.mararadk
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.kararamakarahfgsac.mararadk

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kararamakarahfgsac.mararadk

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kararamakarahfgsac.mararadk

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.kararamakarahfgsac.mararadk

Performs UI accessibility actions on behalf of the user 1 TTPs 5 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.kararamakarahfgsac.mararadk
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.kararamakarahfgsac.mararadk
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.kararamakarahfgsac.mararadk
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.kararamakarahfgsac.mararadk
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.kararamakarahfgsac.mararadk

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kararamakarahfgsac.mararadk

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kararamakarahfgsac.mararadk

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.kararamakarahfgsac.mararadk

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.kararamakarahfgsac.mararadk

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kararamakarahfgsac.mararadk

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kararamakarahfgsac.mararadk

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kararamakarahfgsac.mararadk

com.kararamakarahfgsac.mararadk
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4365
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/oat/x86/qimuMe.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4436

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kararamakarahfgsac.mararadk/app_buddy/oat/qimuMe.json.cur.prof

Filesize
3KB

MD5
f3cff9ff801324748e60743b6f5187fa

SHA1
cfd871583fec1c27e9a69572ec6035c66d3a17d8

SHA256
5b253af2121b494fa038b9b9fa51a348b333c736c7028404b2579b0dab7299d3

SHA512
6feb8997b59019003c1f3e2fea081d99fac936fed9101a4c0a8b232890c2808944063b22c140297ffcb908760424642db4bd1e3d210a90341b771e2a2a3d608a

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json

Filesize
736KB

MD5
ab42483eb0c830c0b592cf922f0dd78e

SHA1
eecd7472139ff9a3b9de395685432b1d2f630ca9

SHA256
3c32eb57c2b510e1747088f52cf19a172d38aaa5af43ab5d243a91c95742a50f

SHA512
b2f3f99b73c35aa9cb2982f511aa03f0ca63d9f1419a5fbcb28927d3b53aafc0b7359528f7e6547eaeecc2055f2e414ad3c0a1e5b334f7ad9486e22ae884acff

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json

Filesize
736KB

MD5
840bcb002db4e54b56196124c1e80565

SHA1
4137d58593abb62f3e0c53b00aba9d0b12684665

SHA256
4a61b331d74b6e6176fd2af07f286a641e146ca0f598d35109bfef55989479f2

SHA512
cf5d2bb2e76c36d36ce039a2bb72994bcf189af7844899020a4fb28806ce38dca3f407e74c1bfa0ac971fdc755a4ae23d4c73d57b91d55502e7ff193c389b36a

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
6b17c4e45d561bb45f40a075416b93d3

SHA1
2fca9c6e2b423dead0931be54149a4228f36e5a0

SHA256
70f31b6be1218535f449b26a4c5828574fc8f8b708bb8bde3c876cacf68c1bca

SHA512
0bf4c51b37f03c9ffbda2984357849269629f22052ecfb7e80c7bcc31ae9486b5824cb9e1c5c0e187053d32ccb30e00c82407f9c5dfce731c2ba1d7feff1757b

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
6a303c3788e8bd81cfeeeae7431e1812

SHA1
867827ce413b4690c1876bc78146cca988d704de

SHA256
8cbf37f9958c71c5cac840f034a926c1fd9519403645d2151c78209ec99fe5ed

SHA512
7386cbe9c4dcd8947a4874042c89e4fcafc006e3ef5c47906689a0b91d33f7900808fb8885bce0f62d96ade348b07ef0177c908a97e28cc082e4d7282a690a69

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
727338752473dbbc30f722d6c865ea37

SHA1
ffe1839bcb7957f481a96e897181e14e33d51c52

SHA256
2cfef0305413f854b7db1bd4db00f6c8039e6f49c611906a66a769c6aed0a5e8

SHA512
cf7112ae674e5a43baa857fb4d74e9c22860fd289b4db133d2333575099bc0093ce604f97a4e71d429d4712c3570508a13d9dc7ec1a52b3c44fa1195f03e20d5

Download Submit
/data/data/com.kararamakarahfgsac.mararadk/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5c61072b677176a0a28cac307c77bf70

SHA1
b591faa8425329b71e50071186323ddb2eb8802f

SHA256
84cc5a507f6a46033a3e1f6000bae2d6fd4190b097b5c1087f9245157b7834ec

SHA512
9727b79af9c1709208c0f8761ff5f6d7dd507faf8e46c23d3cf6e6018b21d6794b05d5de32df6bb1f684f48a596b86440f15823f0ac85c3c908fb755a41de8b1

Download Submit
/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json

Filesize
1.7MB

MD5
6940607aa1d0a4d0c7968d1357aada81

SHA1
9adf39b3ac22fad56f5499545e014375edb5013e

SHA256
537707535993ebd1582e66a27e673c79f835e67c8aa065f70f50850910dbfb92

SHA512
97f3b9a2f0071a51e7bb0d0f4b6b8c69e5e478a9eb13ca3c7d2f8605b2304150598b971611392ab87bb9012eb0bc960863e905035b22d96c9b180fd5477dbd18

Download Submit
/data/user/0/com.kararamakarahfgsac.mararadk/app_buddy/qimuMe.json

Filesize
1.7MB

MD5
d6e2c5ed461d65f8df2181cfef701968

SHA1
08d5b93228e77f3f28b7b08a226ee9efa41b3218

SHA256
42e0b6e8ad85eb998a6bcd82f95ff8558c78d3c3da8492f93815a0d1e033251b

SHA512
202b068e33054a0057808f50a16a762990149bf372cd71de5b219a431b1cedf38fa51505082fe2bde5bf53bfb5936736f580eeb6a13ec222243da7e466fa15f3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads