Extracted

• • Target

    Test_YouTube_no_block_obf.apk

  • Size

    2.4MB

  • MD5

    c8cdf4ef2c61348d36ef495c64532dbe

  • SHA1

    3770da70850a16ce4b07b6cca55870b312d419ae

  • SHA256

    92fed72453023e0d7a27b471272f8511d2beb144793af9dfffa3caf6f5994261

  • SHA512

    df9ffafc2a583633c702f8957e32a032897820639d6e52fd12442c9f42d2a208f9df5f262707d3615836a62203599ba0cbfb5c75359a891a64ac5f974d2aac5d

  • SSDEEP

    49152:X7MG0EBb3mw9Nl7YwH864fz0Z3/D2z8YoMWy6L4cpjjRl:rMkPNdxpvqIYPWy6pRl

  Score

  10^/10

  ermacbankerevasioninfostealerransomwaretrojanstealth

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac2 payload

  • Makes use of the framework's Accessibility service.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3