Extracted

Extracted

• • Target

    a1ea4dbd8a36c410fd528f81f197421c6a8b9b240dd274a87be66f199ad5cb74

  • Size

    2.5MB

  • MD5

    80eedb8d0b108ca485b80c70fc9c2d31

  • SHA1

    7e549c9b8e02cfa696485ef43fa16d196f70bebc

  • SHA256

    a1ea4dbd8a36c410fd528f81f197421c6a8b9b240dd274a87be66f199ad5cb74

  • SHA512

    04e93ba7d30a609cf5c4de8598fceba3e09c4e323ff2e35ae05aefaf0b2008710c7829bd4ff9ebf44d62f76d3a6a5f06346acc24d5a0c46f3c5c5a91181cf49c

  • SSDEEP

    49152:+Y4Hzl+bwEPg8240tzCW3sX77MXQw4CmE4i85W3//t:+JHzl+bn0tzCW3y77ZN7i852t

  Score

  10^/10

  ermachookbankerevasioninfostealerransomwarerattrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac2 payload

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook

  • Makes use of the framework's Accessibility service.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    banker

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3