Extracted

• • Target

    c681ffcfd808a31fa2061c505824dfd3aa0b488b1a4f356dc74aad35b556c896.zip

  • Size

    1.7MB

  • MD5

    ad5c64ecb9d4d0cc55d3d28ce6d74cf5

  • SHA1

    f5eec31be9de22ba2189b82b95c38ebf36d832f2

  • SHA256

    c681ffcfd808a31fa2061c505824dfd3aa0b488b1a4f356dc74aad35b556c896

  • SHA512

    34416a74ec97608e8e9aaa252314757204149cd986d98ac3a4c3c2ef3ba0903f05901f9eeec904aa19a8629032702b23d52f6f8cb75eeb2a6509db3f8fb54280

  • SSDEEP

    24576:6qXR/4N9aIyYcWa4fwaIGJgUQQksADiqeRytdkP2yOf0TwsEVU1poT7/MWcQPAwj:XNcaIO4fgGJggAdkP2ynubT7kZ87r

  Score

  10^/10

  ermacbankerevasioninfostealerransomwaretrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac2 payload

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3