hermit | 243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e

General

Target

243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e
Size

2.9MB
Sample

240410-lz1z3sef3s
MD5

5d892168472ed4a87a60721c02330f15
SHA1

97ead8dec0bf601ba452b9e45bb33cb4a3bf830f
SHA256

243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e
SHA512

e8aa2aecbde4c0385b5027a0920cb4dd3d19267e2ef2155f74d8b90425697c7a5421f31a3d12ee5f6fb904ad82514c9de7f2d1e7d53e43f50aa2b179434ec60a
SSDEEP

49152:x7LP4p94zO8tBKX4wbX447y0duRMQ7NqyuHbEdyqDVMl8aS:xHQF4Y20qNLlzDVeS

Score

10^/10

Malware Config

Targets

- Target
  
  243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e
- Size
  
  2.9MB
- MD5
  
  5d892168472ed4a87a60721c02330f15
- SHA1
  
  97ead8dec0bf601ba452b9e45bb33cb4a3bf830f
- SHA256
  
  243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e
- SHA512
  
  e8aa2aecbde4c0385b5027a0920cb4dd3d19267e2ef2155f74d8b90425697c7a5421f31a3d12ee5f6fb904ad82514c9de7f2d1e7d53e43f50aa2b179434ec60a
- SSDEEP
  
  49152:x7LP4p94zO8tBKX4wbX447y0duRMQ7NqyuHbEdyqDVMl8aS:xHQF4Y20qNLlzDVeS
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device.
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2