Extracted

Extracted

• • Target

    0374f6231210d9f796a43dbab1933d2afc5c4d4781eb53dde223364646365a61.bin

  • Size

    2.5MB

  • MD5

    fb93fa674322ad73c001429e34242807

  • SHA1

    c73055a5a32a00c1a460786fe526377971556caf

  • SHA256

    0374f6231210d9f796a43dbab1933d2afc5c4d4781eb53dde223364646365a61

  • SHA512

    359bef93a6082ad05efe593cd34e37c753e96935c4d5fb5ca42b569f8f540e8bac91f01b9eaee5619aeb3ea48214eed4a6c070624b0f4333e38b9d1a7343b814

  • SSDEEP

    49152:vHRoZ9gWJ4OrLrgv1seGEl3+0ujWHB9Z6s5m2AtSNkD5/vcrG8QN:poZ2yl61NG6ija9P5m5Kky7q

  Score

  10^/10

  ermachookbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac family

    ermac

  • Ermac2 payload

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook

  • Hook family

    hook

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests accessing notifications (often used to intercept notifications before users become aware).

    collectioncredential_access
  behavioral1behavioral2behavioral3