Extracted

• • Target

    5-aligned-signed_en.apk

  • Size

    3.8MB

  • MD5

    239e33c64d322f85cc05cc2d2a5234f4

  • SHA1

    223efb835a820ad6bd4611b9eba3e9eb0d159736

  • SHA256

    dfc6b7f14b14efcb7914cc06638de4fc6807b46d0cd5c6e1ad48e6dc247da0c7

  • SHA512

    7ce21abdeaf7d81f0731dc8478ef6260b8ef9f74c4e0a31733a1102ce35aef32d44c48e22192a644aa8ca856e7d2e3081fb96eccdb632dd9a26d2bf07f3e8a85

  • SSDEEP

    98304:k20r2QFjrI1AuY/QtkxjC4Niw1Jo75ckB4E7EmbER5tH7:kPrxRydtkXSZ4E9bE9

  Score

  10^/10

  ermacbankercollectioncredential_accessdiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac2 payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion
  behavioral1behavioral2