Extracted

• • Target

    bdfe19b2679bac5d6e4b94267eb77c54f1ff9a723d52e5fbbab98f1941fa85c3.bin

  • Size

    818KB

  • MD5

    11ad2c8a151cf2f25ace7cc07ce95e0e

  • SHA1

    61060d76fa66ae42689b9d9d9dba17e5bf372b77

  • SHA256

    bdfe19b2679bac5d6e4b94267eb77c54f1ff9a723d52e5fbbab98f1941fa85c3

  • SHA512

    d0bb011b225dd9621d28ebacb0c98269237848eb4c296de371eccc500caf5660b8a677da58efd3aa31ac5a7ba95c25b89c2b1a65ed355ca52f1ef35f8e451302

  • SSDEEP

    12288:B9+izVk9fuA4dz2CCktVMOfoOVh1ei4f3xvYwnQ6jsD9ocd8W:Jjdz2CCCp/1v4f5Y1UsD9oi

  Score

  10^/10

  ermacbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencetrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Prevents application removal

    Application may abuse the framework's APIs to prevent removal.

    evasion

  • Checks CPU information

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery

  • Checks memory information

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the mobile country code (MCC)

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Registers a broadcast receiver at runtime (usually for listening for system events)

    persistence

  • Acquires the wake lock

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery
  behavioral1behavioral2behavioral3