General

  • Target

    JobPortal.apk

  • Size

    266KB

  • MD5

    8b2ad08dbc35fd433c47342a8b447946

  • SHA1

    df71b4495d07c7f1e000d007bff413e6edd79a86

  • SHA256

    815a231610d6d69cd7bb8a69cf509a7420d20c24189334170466869e851683f8

  • SHA512

    5aad00684b049e9d54b41b895400c6ce62ea121eab17815c6e060f4bcf601a8d617d6adfc7f67b73d424e115bc832601fae5b8c67a1ff50a29d2be7a50e0dfef

  • SSDEEP

    6144:cEIvHgmbSUbkC/0BDTRS29vttKXhf6WkNqYFt9mrzHvNv90g:cEEAbUrcl1t9ltKoWknLmH995

Score
10/10

Malware Config

Extracted

Family

ahmyth

C2

http://172.17.0.4:22222

Signatures

  • Ahmyth family
  • Requests dangerous framework permissions 11 IoCs

Files

  • JobPortal.apk
    .apk android

    com.etechd.l3mon

    com.etechd.l3mon.MainActivity


Android Permissions

JobPortal.apk

Permissions

android.permission.WAKE_LOCK

android.permission.CAMERA

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_CALL_LOG

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_CONTACTS