Extracted

• • Target

    8f2069c23fdfb62ab637f746854a18cb068f52da38bc06e95a7cf2ae07a907ad

  • Size

    978KB

  • MD5

    c112d68f92812ab0d8dfcb105cc7658f

  • SHA1

    9c52011ac19d6acf8c044bfa09bc32dfa202233f

  • SHA256

    8f2069c23fdfb62ab637f746854a18cb068f52da38bc06e95a7cf2ae07a907ad

  • SHA512

    e3ff2bfc6e8b3357f3c76528b51850497b014bbeec4899dac4d424534e52813606fb2c375aa9e94a15c8b113b698cb0d02a79eec01470d150ffa5376e1c868a9

  • SSDEEP

    24576:GTO1XXkclB8C5P4sAcxN+UiEJics5cgSCUKX:GaBkclB8C5zA8UAgSW

  Score

  10^/10

  ermacbankerevasioninfostealerstealthtrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock

  • Queries the unique device ID (IMEI, MEID, IMSI)

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3