ahmyth | Framework1[.]0[.]apk

General

Target
Framework1.0.apk
Size 293KB
Sample230901-a7dzqsbd4x
SHA256 442016df9ae41e675b20c6a225282cffcf8f4e259ac50d04497c9c9c8e60c452
MD5 a3d2be01b33a758822f1640c32788f32
SHA1 71ba7ada38b96220eac9d172310933a83e9a8649
SHA512 25134cb72a544981cea0c3e1133a098cfd4c30fa7677f20376d511fceeb469d005fa2749d5b205bc6d635de36cddb2dde668935b57ce250e102885f00261888e
SSDEEP 6144:6f7KQq29bsCBcUP/9xLZR+1ZBct5Ec3I8bfPHdD8LX:m7Kn2oCiQ9u7ct5ETg9D8r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ahmyth

Malware Config

Extracted

Family

ahmyth

C2

http://8.tcp.ngrok.io:11735?model=

Signatures

Ahmyth family
ahmyth

Requests dangerous framework permissions 14 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

File Explorer

Framework1.0.apk

.apk 293KB

Framework1.0.apk

SHA256 442016df9ae41e675b20c6a225282cffcf8f4e259ac50d04497c9c9c8e60c452
MD5 a3d2be01b33a758822f1640c32788f32
SHA1 71ba7ada38b96220eac9d172310933a83e9a8649
SHA512 25134cb72a544981cea0c3e1133a098cfd4c30fa7677f20376d511fceeb469d005fa2749d5b205bc6d635de36cddb2dde668935b57ce250e102885f00261888e
SSDEEP 6144:6f7KQq29bsCBcUP/9xLZR+1ZBct5Ec3I8bfPHdD8LX:m7Kn2oCiQ9u7ct5ETg9D8r
MD5 SHA1 SHA512 SSDEEP

android

ahmyth.mine.king.ahmyth

Android Permissions

Framework1.0.apk

Permissions

android.permission.WAKE_LOCK

android.permission.CAMERA

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.READ_CALL_LOG

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_CONTACTS

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.REQUEST_IGNORE_BATTERY_OPTIMISATIONS

Framework1.0.apk

ahmyth.mine.king.ahmyth.MainActivity

ahmyth.mine.king.ahmyth.MainService

ahmyth.mine.king.ahmyth.MyReceiver

ahmyth.mine.king.ahmyth.AdminReceiver

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Framework1.0.apk

ahmyth.mine.king.ahmyth.MainActivity

ahmyth.mine.king.ahmyth.MainService

ahmyth.mine.king.ahmyth.MyReceiver

ahmyth.mine.king.ahmyth.AdminReceiver

Android Permissions

Framework1.0.apk