Extracted

• • Target

    41baf399eb5cbe2734e59083db34a746b75680e59cc6479b7185c24bbe5e6945.bin

  • Size

    3.2MB

  • MD5

    2c2c5de98617fc870459f528bb6abb91

  • SHA1

    b33b46aaf2380accca4fac3224810e281ccd7f1e

  • SHA256

    41baf399eb5cbe2734e59083db34a746b75680e59cc6479b7185c24bbe5e6945

  • SHA512

    5be9eeb54b44585b91e6afecdfb2dadc35931795ba92a9771e32fb4d33e8e8edb4b41569afdb67860a2e7530fb5d68f540c2dea9c447943938755cf6f69f3692

  • SSDEEP

    49152:9Br0Fq9Ttu/GgSg468yO5V2sYbzlX5bqlApkC4YR5AGqJ5IDmO+nnVcTG1:30kt0Lx8yOlYTqlApknYRiJ5IhInMG1

  Score

  10^/10

  ermacbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac family

    ermac

  • Ermac2 payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3