Extracted

• • Target

    app-release-3.apk

  • Size

    911KB

  • MD5

    94e226528cbae145be1e568e5594588c

  • SHA1

    d35e5f56544e39febb6bca4aa7fc095a4f801258

  • SHA256

    1d8e17c649fba3c585dfd7d64fd647c7084d9c0abb0cd84182827743f6f7dcb5

  • SHA512

    e5f004cc1035f126f980bd34c3293b4991b9c462591b6930f708befd0a8ba7097a1f1ac44cb5407c0796b618c325e27685252f207a25e73200f5de63a6ea8d8b

  • SSDEEP

    12288:lmP7fUK/nQMualUK15GqhW7FKhudf+u+zUf130RnPZQ1oQUp3dSklK0EZvgA4qD0:wPjUSQMulz+zXnPYoXzSk00Ivg/kf/c

  Score

  10^/10

  ermacbankerevasioninfostealerransomwarestealthtrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock.

  • Queries the unique device ID (IMEI, MEID, IMSI).

  • Reads information about phone network operator.

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Removes a system notification.

    evasion

  • Uses Crypto APIs (Might try to encrypt user data).

    ransomware
  behavioral1behavioral2behavioral3