ermac | 2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d | Triage™

Resubmissions

28/09/2021, 10:19

210928-mc171abgaj8

28/09/2021, 09:45

210928-lrjqtsbdh68

Sharing

Copy URL Twitter E-mail

General

Target
2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d.apk
Size 3.5MB
Sample210928-mc171abgaj
SHA256 2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d
MD5 678317ea1af55da1cddab31417a3c173
SHA1 07f0fb32e675ae022c96a54ac4ed7aa0c21c052d
SHA512 b135fbedddfb0c1942a59ac016159273ad0f50b717412520a22b48bc2c953134033930dcd751fc7018abcf765908f954f27b5b0f1ba323a914e090cd232a6df7
MD5 SHA1 SHA512

Score

10^/10

ermac android banker infostealer obfuscation ransomware trojan

Malware Config

Targets

- Target
  2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d.apk
- Size 3.5MB
- SHA256 2de0f59fd03512e5527c8b8b19595483564ae54cd4904457c4f5bf127949019d
- MD5 678317ea1af55da1cddab31417a3c173
- SHA1 07f0fb32e675ae022c96a54ac4ed7aa0c21c052d
- SHA512 b135fbedddfb0c1942a59ac016159273ad0f50b717412520a22b48bc2c953134033930dcd751fc7018abcf765908f954f27b5b0f1ba323a914e090cd232a6df7
- MD5 SHA1 SHA512
Score

10^/10

ermac banker infostealer obfuscation ransomware trojan
- Ermac
  An android banking trojan first seen in July 2021.
  banker trojan infostealer ermac
- Ermac Payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

ermacbankerinfostealerobfuscationransomwaretrojan