Extracted

• • Target

    495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617

  • Size

    3.7MB

  • MD5

    a88a497b3ae6bb84209cac0906df61a7

  • SHA1

    fd80903a98e187bc841a0aabe04528cc1654b8ee

  • SHA256

    495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617

  • SHA512

    684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a

  • SSDEEP

    49152:4GXx4KE5XqsZKV0dw8zbn3A9/HKu84zXYenCh4ebzds31j/D0NcxZBD5I:cz5XqsZDnwxnXYenUP/dsOyxrD+

  Score

  10^/10

  ermacbankerevasioninfostealerransomwaretrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac payload

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3