General

  • Target

    6e7f74f053500455d8687216b66584f5c2e9f5da60834dead230b208f5240809

  • Size

    15.3MB

  • Sample

    220511-dfh16agghq

  • MD5

    2bf4d287dbca66e3f21fdb477a984f16

  • SHA1

    27e937199eaa2d93b236571093e4838512ab5d88

  • SHA256

    6e7f74f053500455d8687216b66584f5c2e9f5da60834dead230b208f5240809

  • SHA512

    4b6bbc68f8e85900ad6da1cc8a14cf469f8d9ae9012aec5d0d0023b14130f61ce34f8818d99c47c0ee5d042f538987712d06927b5bcc2962666eb0bd89005945

Malware Config

Targets

    • Target

      6e7f74f053500455d8687216b66584f5c2e9f5da60834dead230b208f5240809

    • Size

      15.3MB

    • MD5

      2bf4d287dbca66e3f21fdb477a984f16

    • SHA1

      27e937199eaa2d93b236571093e4838512ab5d88

    • SHA256

      6e7f74f053500455d8687216b66584f5c2e9f5da60834dead230b208f5240809

    • SHA512

      4b6bbc68f8e85900ad6da1cc8a14cf469f8d9ae9012aec5d0d0023b14130f61ce34f8818d99c47c0ee5d042f538987712d06927b5bcc2962666eb0bd89005945

    • Agent smith

      Agent smith is a modular adware that installs malicious ADs into legitimate applications.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries the unique device ID (IMEI, MEID, IMSI).

    • Requests dangerous framework permissions

    • Reads information about phone network operator.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks