Description
Agent smith is a modular adware that installs malicious ADs into legitimate applications.
a9450e63452babcfd011dcb4c91446a0524dd1b1910b879ffe8e0aaa587dec4d
General
Target
Size
Sample
a9450e63452babcfd011dcb4c91446a0524dd1b1910b879ffe8e0aaa587dec4d
2MB
220521-ax7t3aahh3
Score
10 /10
MD5
SHA1
SHA256
SHA512
badd1f1f06deb17261c08184d243fba7
a2189d43278760394176828a09e996100474c581
a9450e63452babcfd011dcb4c91446a0524dd1b1910b879ffe8e0aaa587dec4d
9716d869bbe56997a9ef53b2c553caed6960c9b528413a1916882411db0f7e5800b522970ae6f2ea453f1e3858820d61f3f060b0a9e059d0935e2bd8f4b51457
Malware Config
Targets
Target
MD5
Filesize
a9450e63452babcfd011dcb4c91446a0524dd1b1910b879ffe8e0aaa587dec4d
badd1f1f06deb17261c08184d243fba7
2MB
Score
10/10
SHA1
SHA256
SHA512
a2189d43278760394176828a09e996100474c581
a9450e63452babcfd011dcb4c91446a0524dd1b1910b879ffe8e0aaa587dec4d
9716d869bbe56997a9ef53b2c553caed6960c9b528413a1916882411db0f7e5800b522970ae6f2ea453f1e3858820d61f3f060b0a9e059d0935e2bd8f4b51457
Tags
Signatures
-
Agent smith
-
Requests cell location
Description
Uses Android APIs to to get current cell location.
-
Loads dropped Dex/Jar
Description
Runs executable file dropped to the device during analysis.
-
Requests dangerous framework permissions
-
Reads information about phone network operator.
-
Uses Crypto APIs (Might try to encrypt user data).
Tags
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks