Extracted

• • Target

    paypal.apk

  • Size

    2.6MB

  • MD5

    16e991d73049f1ef5b8f5fa0c075ef05

  • SHA1

    79b5c686478c3db742666068d3835eb3409af32a

  • SHA256

    f4ebdcef8643dbffe8de312cb47c1f94118e6481a4faf4166badfd98a0a9c5d3

  • SHA512

    4b6709f86718a6348feb4dffbf9094594ae269b89a4ff7dac2c0d83f6320f46a3958711ad9c6e49121eedd0e47d5365d19275459653992366c62ce2d1643801e

  • SSDEEP

    49152:Y/cThIEUoEPCM0FjUT8uD4f14CUnA6CKe8NbLDMR:YEFIdP9q9GTn9CctX8

  Score

  10^/10

  ermacbankerevasioninfostealerransomwaretrojanstealth

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac2 payload

  • Makes use of the framework's Accessibility service.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    banker

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3