hermit | 6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba

General

Target
6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba
Size 2.9MB
Sample240410-nxmqsaee48
SHA256 6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba
MD5 b0c5b2b4d6678c9faa5140a040a1ab73
SHA1 ca101ddfcf6746ffa171dc3a0545ebd017bf689a
SHA512 4ac35472e292b4491e96d32ccd73f73fef10ed90070bcc16d1c69b0c800762a47fde01871a75274b2036eeb76705767c9a4d282e1f57bf55931da9011195e2fd
SSDEEP 49152:duRML7jNf7mUqyKD/09lXUKhoHvoiUc/l9tZ5yHKhs76ry5K+X6j1VHzfjqD:1jN7xLG/Ul70RUcN9tXkj7eH+Xu1JzfS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba
- Size 2.9MB
- SHA256 6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba
- MD5 b0c5b2b4d6678c9faa5140a040a1ab73
- SHA1 ca101ddfcf6746ffa171dc3a0545ebd017bf689a
- SHA512 4ac35472e292b4491e96d32ccd73f73fef10ed90070bcc16d1c69b0c800762a47fde01871a75274b2036eeb76705767c9a4d282e1f57bf55931da9011195e2fd
- SSDEEP 49152:duRML7jNf7mUqyKD/09lXUKhoHvoiUc/l9tZ5yHKhs76ry5K+X6j1VHzfjqD:1jN7xLG/Ul70RUcN9tXkj7eH+Xu1JzfS
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device.
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2