Extracted

• • Target

    GoogleMaps.apk

  • Size

    907KB

  • MD5

    ea449f22d8dd8d8fe8732dd96d69cb99

  • SHA1

    d0656d504fabddb0bccc284976120e1a8299dcde

  • SHA256

    16d5b53c646a760a91b2663ec75035d4a999d4440fbc52e8a96d292d5bee947a

  • SHA512

    0da0a54de3cc28d3d8f8e44748aa2359f048f4c21d319fb2941bd2b4866bb53abdd857b5f27a346daa5b7f79b9a68af89baff598133fb8fe0c1633a820328fe7

  • SSDEEP

    24576:OlFD/teGNYj4ETDPHKDz82qBwWsmEg/WMsa:KzNYjVHqDSsmEg/WA

  Score

  10^/10

  ermacbankerinfostealerransomwaretrojanevasionstealth

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3