Extracted

• • Target

    d78f5b633d91250b783b62b4ea7141bf46293cc0d3745f6f42a14b0cd4322c32.bin

  • Size

    1002KB

  • MD5

    c312fbbacce545a419b5e88b6267c58a

  • SHA1

    1aa517acd6ec474c04e9646edf6c1776c052c495

  • SHA256

    d78f5b633d91250b783b62b4ea7141bf46293cc0d3745f6f42a14b0cd4322c32

  • SHA512

    1a1ce06870b6c9474a3477ac6813f9df00496f12361ec9808dcbe193e375c8ab9f8123f3081ddd896625aeda76db6ecc4a14eaa44f5bd42344058771ab495e2a

  • SSDEEP

    24576:997oSX6wvqGHV4ffMpbjUr1Mjd8/d8xd8Wd86d8Dd88d83d8ad8fd8osF:9C2514fcnksF

  Score

  10^/10

  ermacbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

  • Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Ermac family

    ermac

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3