ahmyth | e0eacd72afe39de3b327a164f9c69a78c9c0f672d3ad202271772d816db4fad8[.]zip

General

Target

e0eacd72afe39de3b327a164f9c69a78c9c0f672d3ad202271772d816db4fad8.zip
Size

342KB
MD5

0ea764afa833084b76e270f8e092204b
SHA1

92e0bf9db0311561376026cb3bfeb858d2d253d9
SHA256

e7f867923fd164c221616c59edf06d5c9f419bf76c508af26be541ab16745868
SHA512

a0e982acc578b397652e8a37e7e67b7adb64683fc6fa24aed9c1cafc0e689522b8fbaf9a5bf0442ce4cf41c3f25c119d688160ab0002b38d39c82eaadabfe373
SSDEEP

6144:Ex+uf/sJRaGItqp6zo9f3k7ONT76UB2jJdqGqimQq+2OcQGEgp3g7:6nsJ0GbpLUyNuU6jMJOcTEgs

Score

10^/10

ahmyth

Malware Config

Extracted

Family

ahmyth

C2

http://82.146.35.240:80

Signatures

Ahmyth family
ahmyth

Requests dangerous framework permissions 11 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

Files

e0eacd72afe39de3b327a164f9c69a78c9c0f672d3ad202271772d816db4fad8.zip
.zip

Password: infected
e0eacd72afe39de3b327a164f9c69a78c9c0f672d3ad202271772d816db4fad8.apk
.apk android

com.remote.app

com.remote.app.MainActivity

Activities

com.remote.app.MainActivity

android.intent.action.MAIN

Permissions

android.permission.WAKE_LOCK
android.permission.CAMERA
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_CALL_LOG
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_CONTACTS
android.permission.FOREGROUND_SERVICE

Receivers

com.remote.app.DeviceAdmin

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_DISABLED
android.app.action.ACTION_PASSWORD_CHANGED
android.app.action.ACTION_PASSWORD_EXPIRING
android.app.action.ACTION_PASSWORD_FAILED
android.app.action.ACTION_PASSWORD_SUCCEEDED

com.remote.app.ServiceReciever

respawnService

com.remote.app.MyReceiver

android.intent.action.BOOT_COMPLETED
android.provider.Telephony.SECRET_CODE
respawnService

Services

com.remote.app.NotificationListener

android.service.notification.NotificationListenerService

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

com.remote.app

com.remote.app.MainActivity

Activities

com.remote.app.MainActivity

Permissions

Receivers

com.remote.app.DeviceAdmin

com.remote.app.ServiceReciever

com.remote.app.MyReceiver

Services

com.remote.app.NotificationListener