Extracted

Extracted

• • Target

    4276d1649764516e99b72407e57d45e9cf533c54a1b244c0e31a0cb8282ee1c1.bin

  • Size

    2.5MB

  • MD5

    cc7de0255e16e361c0f34130239b6a62

  • SHA1

    82d69aae36cedbb589138665659777198e2bfaf2

  • SHA256

    4276d1649764516e99b72407e57d45e9cf533c54a1b244c0e31a0cb8282ee1c1

  • SHA512

    71b5f4a60fe2bffbd45e5fe1399ee91e14d3f3d363c0674595e8d67b527a0a4bfc59d68d1e1f69b5d61659dea801aa773b0a4ed7f46f7726a5ea804ca0d0ca2a

  • SSDEEP

    49152:sl6Q5bjxjfdPxZzqVvqH6pUvtcbW2IgsYDRLJB2A2+XW3fJmD:sDBjfdjqVni1cbW2IgsURz2+XufE

  Score

  10^/10

  ermachookbankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistencerattrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac family

    ermac

  • Ermac2 payload

  • Hook

    Hook is an Android malware that is based on Ermac with RAT capabilities.

    rattrojaninfostealerhook

  • Hook family

    hook

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries information about running processes on the device

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3