Description
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
44710fe018450f47310c7ab69654201de8a72253ee564ab11f12e733a88bea7f
General
Target
Size
Sample
44710fe018450f47310c7ab69654201de8a72253ee564ab11f12e733a88bea7f
2MB
220515-1rhk4abbaj
Score
10 /10
MD5
SHA1
SHA256
SHA512
69aea2e544b21e5650d6063afbf24d11
3a7fc7497f0a3551368b46a3a279a4df8db551ec
44710fe018450f47310c7ab69654201de8a72253ee564ab11f12e733a88bea7f
610d4c420879dba20d31ae130cf2cbafbdf9cdbeddf1699700a4ec81c67acffcef48231b87b9d982c1d6773465d4bf2b9e8cda80d65a41579ac9137025c1dc6e
Malware Config
Targets
Target
MD5
Filesize
44710fe018450f47310c7ab69654201de8a72253ee564ab11f12e733a88bea7f
69aea2e544b21e5650d6063afbf24d11
2MB
Score
10/10
SHA1
SHA256
SHA512
3a7fc7497f0a3551368b46a3a279a4df8db551ec
44710fe018450f47310c7ab69654201de8a72253ee564ab11f12e733a88bea7f
610d4c420879dba20d31ae130cf2cbafbdf9cdbeddf1699700a4ec81c67acffcef48231b87b9d982c1d6773465d4bf2b9e8cda80d65a41579ac9137025c1dc6e
Tags
Signatures
-
Agent smith
-
Requests cell location
Description
Uses Android APIs to to get current cell location.
-
Loads dropped Dex/Jar
Description
Runs executable file dropped to the device during analysis.
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data).
Tags
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks