ermac

General

Target

039c79780123d3a766255749b32800a8082a1fc389455ed9ae9c5d82c0e9f37c.bin
Size

1.2MB
Sample

240401-1xd5vsgd2s
MD5

ed60b0b6d8f192003f2fb8d8afbe78df
SHA1

729f773a78d3958b99114135dc62dd60e10b8c04
SHA256

039c79780123d3a766255749b32800a8082a1fc389455ed9ae9c5d82c0e9f37c
SHA512

ceabec4602e9b301bdbc58199b3d8bd3a9b163bcd46497fdb25da4fe7b3bb8cf63ef6ce655c8b8eed7d731553c28ae6ad8d49d6a45b8be8ab57c92fd7a02a221
SSDEEP

24576:OyUlG6UFYQQVeXJtJeu5XS8UiRCVL3X0Mgh8j2F/vt:X16U6UZeyiz6LI2F/F

Score

10^/10

Malware Config

Extracted

Family

ermac

C2

http://194.26.135.189:3434

AES_key

Targets

- Target
  
  039c79780123d3a766255749b32800a8082a1fc389455ed9ae9c5d82c0e9f37c.bin
- Size
  
  1.2MB
- MD5
  
  ed60b0b6d8f192003f2fb8d8afbe78df
- SHA1
  
  729f773a78d3958b99114135dc62dd60e10b8c04
- SHA256
  
  039c79780123d3a766255749b32800a8082a1fc389455ed9ae9c5d82c0e9f37c
- SHA512
  
  ceabec4602e9b301bdbc58199b3d8bd3a9b163bcd46497fdb25da4fe7b3bb8cf63ef6ce655c8b8eed7d731553c28ae6ad8d49d6a45b8be8ab57c92fd7a02a221
- SSDEEP
  
  24576:OyUlG6UFYQQVeXJtJeu5XS8UiRCVL3X0Mgh8j2F/vt:X16U6UZeyiz6LI2F/F
Score

10^/10

ermac banker collection discovery evasion infostealer persistence stealth trojan
- Ermac
  An Android banking trojan first seen in July 2021.
  banker trojan infostealer ermac
- Ermac2 payload
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Acquires the wake lock
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Ermac2 payload

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Makes use of the framework's foreground persistence service

Acquires the wake lock

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3