Extracted

• • Target

    6e97091787df05f9c69fc18529246829.apk

  • Size

    4.2MB

  • MD5

    6e97091787df05f9c69fc18529246829

  • SHA1

    8b7fd675d02ddf94a9141842252eb54993ce3f6c

  • SHA256

    fdf52cf54b38b6d2cf78fd5c0253626bc9f148db0eb7e307a28349ceab5a7be8

  • SHA512

    b90877a306774f3a41a371b03d04e8b64e8cf10fa500a3312ad1b53c2152ac1345bd3e439f7e47b75ac7a3728f71e41c77400ee50642d66c86a007a7fb37c04d

  • SSDEEP

    98304:irX/MBlBZO8OQ9MoDwS5WETOz8QJy1XEYk+PmfH3BVt7fXSUJg:sX01O1YMo95hTOzPJXOgHZX76

  Score

  10^/10

  ermacbankerevasioninfostealerransomwaretrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    banker

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3