Extracted

• • Target

    e108ea1e0994bc4c630e06154bcff1c699ff316c54a91e22ff2fa57db04fe643.bin

  • Size

    2.3MB

  • MD5

    3bf1c6d473bcc6016df78ad9ca8bae92

  • SHA1

    e5630ebda113ed338aa0fd55de6336bfebec9dd6

  • SHA256

    e108ea1e0994bc4c630e06154bcff1c699ff316c54a91e22ff2fa57db04fe643

  • SHA512

    98a32a3c10be489859b782568729f4bd8b06f6e51a5484b49babf3215025eaae3386bc3a40e6a7837766aee160c922106755357b612a2874413b96ec937e9ea3

  • SSDEEP

    49152:gDtzOHJi+hil20NEGpYXeysPGRoAX3og/cMQXJXuY5Ui:gBzK3il20H9IzQ5+i

  Score

  10^/10

  ermacbankerdiscoveryevasionimpactinfostealerpersistencetrojancollectioncredential_access

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac family

    ermac

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2