Extracted

• • Target

    Xnode_new.apk

  • Size

    1020KB

  • MD5

    814aa96cdcf2dc0d70273e81a3a1c86f

  • SHA1

    65f97e7a924480cc928424b2d7fa565cf3ad8066

  • SHA256

    9f55a2ea4121955b5d2892f11709984d5f0ad6aa7a5a2773b8d5bbc6c04e5fd5

  • SHA512

    b28a62e13e3a9448fc92d18c146660073f71d8aa364b477a41402549dc059e3276799ae62c7836d2b0af93db410196ba1ec9f9270c39fd3773cd2bef566ebec3

  Score

  10^/10

  ermacbankerevasioninfostealerransomwaretrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3