Extracted

• • Target

    d5be61f974234f7ee6e4eaa21072a45c77f9d5742101842b58bf3381033154f5.bin

  • Size

    937KB

  • MD5

    172db8f1dcdd7152609f820a5b6ddb0c

  • SHA1

    3f28c6a36126a71a9c132209275c4c6414666ed9

  • SHA256

    d5be61f974234f7ee6e4eaa21072a45c77f9d5742101842b58bf3381033154f5

  • SHA512

    31a6108d1b4eef9381524d44201d2c9807614cbbd158260a6b39a74311b3bd2ebc0125ea995ca1883f2c5e3e011960698f77db170a5d5910712f9965c449c64e

  • SSDEEP

    24576:Ovnc5Fq+9iXoDM4gsuXYiLHzSV+1g/G1Pa:4+FeoDM4puXV6Y1g/Ia

  Score

  10^/10

  ermacbankerevasioninfostealerstealthtrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    banker

  • Removes its main activity from the application launcher

    stealthtrojan

  • Acquires the wake lock

  • Queries the unique device ID (IMEI, MEID, IMSI)

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2behavioral3