Extracted

• • Target
    17f953c6362e451da1786816a0d8d7d1_0dc975df4f929ed0422fb5c9a9582d3d5e11ab176cc3176e269b2a456d48d571.apk
  • Size 1.9MB
  • SHA256 0dc975df4f929ed0422fb5c9a9582d3d5e11ab176cc3176e269b2a456d48d571
  • MD5 49305965693a47cac8fe54d325d50d1f
  • SHA1 7b7fbbe3f02ead6e985cf4619948ce003b4eb3f3
  • SHA512 afdccaa0a03046355adfed5526cdec0881f68b6073eb0a574b21b08cc9abafda4ac8fe0ec6382881fb641a38b33b9f5f617ff822db7d8ef4bd5c32fbeec70322
  • SSDEEP 49152:L7u2h4TxtyrD/V9oVrI1w4fmswmfC00Sql2x6I:Pu4Rv4E1AvKC00NlRI
  • TLSH
    T1F595F112FBCAA82EECF3C335477A4A6A55429D668343E7838964717C0DBB5C08E46FC5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerclippercollectioncredential_accessdefense_evasiondiscoverydropperevasionexfiltrationermacimpactinfostealerobfuscatedoverlaypersistencesmsstealerstealthtrojan

  • Ermac2 payload

  • Family: Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Android banker: accessibility service abuse with overlay injection

    DEX references AccessibilityService event hooks together with window-overlay creation and credential-capture primitives. This combination is the canonical Android banking-trojan pattern: the app reads screen content and injects fake login windows over legitimate banking apps.

    bankertrojanoverlay

  • Clipboard monitoring with cryptocurrency address substitution

    Watches clipboard changes and matches the contents against cryptocurrency address formats before writing a replacement value. The embedded address patterns exist so the app can recognise a copied wallet and swap in the operator's own, redirecting outgoing transfers.

    stealerclipper

  • Contact harvesting with SMS self-propagation

    Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

    smstrojanexfiltration

  • Encrypted or packed staged payload inside Android package

    Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

    obfuscateddropper

  • Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks Android system properties for emulator presence.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3