ermac | 6ca691c97ab0028ce9acade5d079289668b1d0339ad330181c84fc7e7114c509

Analysis

max time kernel
147s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
04/11/2025, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 3.5MB
Sample251104-ar6ptaaq2v
SHA256 68d0569af255f25f773e3e4f9506b1d253ea108511b4df70b45430f6a5691090
MD5 41eae3fea4761463a82c98b1e9b88504
SHA1 159ffafa7b9bb3824b924402714dacbb33284092
SHA512 9630429ff1e8afcc415f2a42103f3aea1afb12af0ca8cfcca9c30f1725ed0020a6a13007b837ec6b4716cf9c220298b6ec45c05a9551ee6a3936c18300a1a2e5
SSDEEP 98304:KN+2eWaL3X0LixH+pvRbKn8x2GwituDSQMGO:h2eWI3XgSH+pZbKnk2GluDS1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution ermac hook impact infostealer persistence rat trojan

Malware Config

Extracted

Family

hook

http://hrjob-forward-build.store

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36

Extracted

Family

ermac

http://hrjob-forward-build.store

AES_key

Extracted

Family

hook

http://hrjob-forward-build.store

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac
Ermac family
ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral4/memory/4233-0.dex	family_ermac2
behavioral4/memory/4207-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook
Hook family
hook

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xoyitomesavile.gozuba/app_pride/XHPji.json	4233	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xoyitomesavile.gozuba/app_pride/XHPji.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xoyitomesavile.gozuba/app_pride/oat/x86/XHPji.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xoyitomesavile.gozuba/app_pride/XHPji.json	4207	com.xoyitomesavile.gozuba

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.xoyitomesavile.gozuba
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.xoyitomesavile.gozuba
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.xoyitomesavile.gozuba

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xoyitomesavile.gozuba

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.xoyitomesavile.gozuba

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.xoyitomesavile.gozuba

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xoyitomesavile.gozuba
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xoyitomesavile.gozuba
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xoyitomesavile.gozuba
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.xoyitomesavile.gozuba

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xoyitomesavile.gozuba

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xoyitomesavile.gozuba

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.xoyitomesavile.gozuba

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.xoyitomesavile.gozuba

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xoyitomesavile.gozuba

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.xoyitomesavile.gozuba

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xoyitomesavile.gozuba

com.xoyitomesavile.gozuba
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4207
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xoyitomesavile.gozuba/app_pride/XHPji.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xoyitomesavile.gozuba/app_pride/oat/x86/XHPji.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4233

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

XHPji.json

Path /data/data/com.xoyitomesavile.gozuba/app_pride/XHPji.json
Size 685KB
SHA256 81d4d5058149c0a5e6bff79a4776f9d2da102290f2c043547c6279850f97c521
MD5 257a7091c7bbec51d8ff986a7b414e6c
SHA1 e9a911952fe615e057b2787337c7e74645e64fba
SHA512 bf36ad2081a431271e8d342e2cbbbbd9244b6631baccc5d196cb12efac99cac872d1cb4d01d472e15c62d507dd299d48f74541b85e9bb1130b76836209e02254
SSDEEP 12288:QgLtAQZcfRAuFay1Oqd4bMMcMqsvhPMdJslXL2dyMTwV77qQNkBF/8mGzdiS:gffqS2qdOMMFqEqel7eyMTG3fNgGRiS
MD5 SHA1 SHA512 SSDEEP

Submit Download

XHPji.json

Path /data/data/com.xoyitomesavile.gozuba/app_pride/XHPji.json
Size 685KB
SHA256 8911460bbbb24a693c5866a80b03d115dcf0c82071833ff5f95e6722219eede0
MD5 0e772de9fe7583d58898e259c80f4661
SHA1 02e508ef8fbdf6c8d7a00860e8220cfdc77ba1ed
SHA512 76e596cb6b8892291b247a2c148b4fd32eca08584b3fbcf81c1681e5ecfe2f57a71b043ed6b79c9399559ce7350b363065a9af0d1e904ece9e80244e92f2413d
SSDEEP 12288:TZxUlBaju3JaXXyGQAcE/+hZ8ux1hiSaQ5LMw3AvZQI1OEz3lVv:FxUloju3AvQDhZLxvi6McAvZtv
MD5 SHA1 SHA512 SSDEEP

Submit Download

XHPji.json.cur.prof

Path /data/data/com.xoyitomesavile.gozuba/app_pride/oat/XHPji.json.cur.prof
Size 3KB
SHA256 6f710441c90270f53de2a3b6e43f57b5fb5f8ad4d55b7a821247e67bbd170bda
MD5 0b25c7db750142e9e9d498142a1a498b
SHA1 8127c15737fb0981ebca660751a982cd8fe0e3b7
SHA512 a54acb0fd6603c58c4d2533694739b60d705fed5ca0e1b445e56db8c32da7e9abdeb4bced38e53b019f55c2e0fa18a3edd2a27ddc126fc971aac363bec59b5db
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.xoyitomesavile.gozuba/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.xoyitomesavile.gozuba/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 310eb29af7e5384af51dc92f42457e11dbf90bf3eb9da383014252c42c0d48c1
MD5 2b920e81a1fb7410ce5826ef8adc0fe8
SHA1 6966634c36f70897a0b7a3b7afcea6113ee63020
SHA512 c43c426d889d8a35f8b9a328be79a05fca2b982bb4a55ab65d92dbf5f57125270e144309122af58cbaef091e715950be24542143f31b62ceeed008b785f1f3d0
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.xoyitomesavile.gozuba/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.xoyitomesavile.gozuba/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 b5ad875b9e31947db7b0a560afde417c7823cd56615153bbf73b16ca037c0f0c
MD5 93d4bf6e0d0a23c8035a1d6db52d724d
SHA1 03d50ebbb83f346788679a2659bf0a9c6f32868a
SHA512 e29dad5cd756a8e175458ef0069f32bdd5ce5e6848761deb3b11fee8704192ee44c9d367181a25bb38b89996a0419b5861990ef36554bb6acd2b3d2a6f51d99c
SSDEEP 96:KkZ6+hdjnHtDRMpf8UzS5+TD8q0ExPXx0d:RVdjnHt9Mpf8UzS5+TD8q0E50
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.xoyitomesavile.gozuba/no_backup/androidx.work.workdb-wal
Size 173KB
SHA256 6942ffc72ee82bc8315502c1d63ec4d50acdfb19f461ebcd7fcb6adfc6a378bc
MD5 06b8810e4b3718d885ba6956ae3a91e4
SHA1 28cda244d5eb3cd44bb17d4bec3fc121670a3340
SHA512 8b5339dcda6562e131b88e175b12c1515a28519eea6cc87ecf9a828b050458d149ee01cd36bd189bce835c5bf8d4ac1bf6e60f7c308b9b95c52b18fea306da94
SSDEEP 96:pUTAY1CnTT6CsT6CNCVCACOCWUTAYKFCqCT:pU0Y1CnTGCsGCNCVCACOCWU0Y+CqCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.xoyitomesavile.gozuba/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 4c6d7e1bd8bd019cde9f9e6c4592f2b7e1de8fde555d14cb4e9871c3b14c2c15
MD5 cd2dc91e1deeed5492d73439f865b37b
SHA1 662260be682cc277c18e9201bec67a8fbbf5c255
SHA512 ed79f85c5b5a561daff82093d1eb2337f23bea445293e6ba3974efe7adcd48d7a08c934d374336b76c82ea960add1cd79aac30dccb3a6f34c33a393b28ea4307
SSDEEP 6:K4fa4Q9FZdrlOERX4PBX4ogLugMBX4suuK+/NDll/0fTOw2:K4szdTRmBEyPbP/N7/UTOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

XHPji.json

Path /data/user/0/com.xoyitomesavile.gozuba/app_pride/XHPji.json
Size 1.5MB
SHA256 e2f749aa7897b36127105a0fe0b8ad9079cabdd422cf5e3e32903d2addb04042
MD5 a6332614c8633eceffc14ed7f375b7e7
SHA1 9f5b802d466d4299bcaf66fb382b5e5f26742c20
SHA512 c0c2ad30e8e0332fad20f3f2ade48994690cbb42f7fbacf8c79985992d30a6829a02d4732ce4763a4eb86f6b55ed0b1120c428580695118bc0aa12b29db4d276
SSDEEP 12288:0MGRIdzpP43Tp+Gk0PSt0QPr0UxpCB+NmxBoEXjpxgOHATsemEqXrTSVGw8wd4TP:CRyZS+GzPS2UVxpfmBb6Xzj6ui2qP55
MD5 SHA1 SHA512 SSDEEP

Download

XHPji.json

Path /data/user/0/com.xoyitomesavile.gozuba/app_pride/XHPji.json
Size 1.5MB
SHA256 2f1e8da5b7dd339625ede20a4c73d8eb9fa9154c9d4062f9b5f88ac78277815b
MD5 eed2481761d78efa64045392bb962d5c
SHA1 aba7b72f0409a7d4e59ba12264b1efd02702d8f4
SHA512 3120d4d82c6318d0a2566478bdefc68c16043d3a311637c677d783880bfcc5864cb2ad400833546d1f25d283c6b2864bd68b7e702cc5a39f317c095eebdc257a
SSDEEP 24576:CRyZS+GzPS2UVxpveHoWA4eyLAmXGbtcRuqP55:lXVxJ/WA4enzY
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads