Extracted

• • Target
    495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617
  • Size 3.7MB
  • SHA256 495a0621b2afc6adefbf17dc6c3cf5e92ba8227ac6939a20439b1b9dde878617
  • MD5 a88a497b3ae6bb84209cac0906df61a7
  • SHA1 fd80903a98e187bc841a0aabe04528cc1654b8ee
  • SHA512 684e5ea64375791c2195dd1459d868e6ed2d40ab376b5477e0964c43a4eccc57aab66ce08a55eddb51d1edc6503cf12c9c7ab7f27eb815105ec4ec31ecff5d7a
  • SSDEEP 49152:4GXx4KE5XqsZKV0dw8zbn3A9/HKu84zXYenCh4ebzds31j/D0NcxZBD5I:cz5XqsZDnwxnXYenUP/dsOyxrD+
  • TLSH
    T1BD0633F0EAE7641EC40BEC374095A75AA01DD68F4AC4DA0D5A16C2180DB6FB84F37E97
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexfiltrationcerberusermacimpactinfostealerpersistenceratsmsstealthtrojan

  • Ermac payload

  • Family: Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus

  • Family: Ermac

    An Android banking trojan first seen in July 2021.

    bankertrojaninfostealerermac

  • Contact harvesting with SMS self-propagation

    Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

    smstrojanexfiltration

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Checks Android system properties for emulator presence.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery
  behavioral1behavioral2behavioral3