Overview

overview

10

Static

static

7

53.apk

android_x86

1

53.apk

android_x64

10

53.apk

android_x64

10

Resubmissions

13-07-2022 10:04

220713-l3xrtscgdn 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53.apk

  • Size

    2.3MB

  • Sample

    220713-l3xrtscgdn

  • MD5

    532976a909d2a833efb1dea9f025d63b

  • SHA1

    6af5fc7790be9c0ff466e31dd33ace5b587d2674

  • SHA256

    e726697d7f682a6b2be61ae887b80275ca124da0350020ead46c52781bd22e39

  • SHA512

    83eb6c4c17715936ea8d38b7a92e73a82de91283b7acdcbe9b39aaa9bf18d33441a1f6712a9b32c1e9ee05134725e21f08dc510af387d9a6dbee59a02c7fe078

Score
10/10
ermacandroidbankerevasioninfostealerransomwaretrojan

Malware Config

Extracted

Family

ermac

AES_key
AES_key

Targets

    • Target

      53.apk

    • Size

      2.3MB

    • MD5

      532976a909d2a833efb1dea9f025d63b

    • SHA1

      6af5fc7790be9c0ff466e31dd33ace5b587d2674

    • SHA256

      e726697d7f682a6b2be61ae887b80275ca124da0350020ead46c52781bd22e39

    • SHA512

      83eb6c4c17715936ea8d38b7a92e73a82de91283b7acdcbe9b39aaa9bf18d33441a1f6712a9b32c1e9ee05134725e21f08dc510af387d9a6dbee59a02c7fe078

    Score
    10/10
    ermacbankerinfostealerransomwaretrojanevasion

    • Ermac

      An Android banking trojan first seen in July 2021.

      bankertrojaninfostealerermac

    • Ermac2 payload

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries the unique device ID (IMEI, MEID, IMSI).

    • Reads information about phone network operator.

    • Removes a system notification.

      evasion

    • Uses Crypto APIs (Might try to encrypt user data).

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks