ermac

General

Target

e578094837ef57de94414604d6a39a7966929dc04a693f20244db66fecdfdc98.bin
Size

963KB
Sample

240404-1xw1nsca73
MD5

0afb51d35feaa66b955f8a4def76fc8e
SHA1

6ff59d284b653ae1721c9e25ce3e7b3de1fffaa9
SHA256

e578094837ef57de94414604d6a39a7966929dc04a693f20244db66fecdfdc98
SHA512

22dbe11fa45ddb13ca4bbd5ee60391d36460016edee6ba17e12688e46fa4a08d50e5c75619e88e8acc498844409bbf94f49e7353dec99e3af52defb32284a960
SSDEEP

24576:0Ds45gKn5VHKelHi/CN9dho1KoDSgoBg/TVdj:015gtelC/CN9bPLBg/jj

Score

10^/10

Malware Config

Extracted

Family

ermac

C2

http://147.45.47.46:3434

AES_key

Targets

- Target
  
  e578094837ef57de94414604d6a39a7966929dc04a693f20244db66fecdfdc98.bin
- Size
  
  963KB
- MD5
  
  0afb51d35feaa66b955f8a4def76fc8e
- SHA1
  
  6ff59d284b653ae1721c9e25ce3e7b3de1fffaa9
- SHA256
  
  e578094837ef57de94414604d6a39a7966929dc04a693f20244db66fecdfdc98
- SHA512
  
  22dbe11fa45ddb13ca4bbd5ee60391d36460016edee6ba17e12688e46fa4a08d50e5c75619e88e8acc498844409bbf94f49e7353dec99e3af52defb32284a960
- SSDEEP
  
  24576:0Ds45gKn5VHKelHi/CN9dho1KoDSgoBg/TVdj:015gtelC/CN9bPLBg/jj
Score

10^/10

ermac banker collection discovery evasion infostealer persistence stealth trojan
- Ermac
  An Android banking trojan first seen in July 2021.
  banker trojan infostealer ermac
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Makes use of the framework's foreground persistence service

Queries the phone number (MSISDN for GSM devices)

Acquires the wake lock

Queries the unique device ID (IMEI, MEID, IMSI)

Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3