hermit | a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9 | Triage

Sharing

General

Target

a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9
Size

1.1MB
Sample

240410-qktdxacb9w
MD5

6b69a9bf30d76c135db369956774f2cb
SHA1

22f49fa7fe1506d2639f08e9ae198e262396c052
SHA256

a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9
SHA512

2df561ffe8b9d8ce3ab6b1a5b1eccb4312e7230fa20c4da451e76cdb53e94169ffc4b2fbc0a09fe45ca6e5551921ba51670c087b0eb899ccc9206186ec0b83dd
SSDEEP

24576:idX3e1cFTNITHE4Uo+N6SSmZ1e8+wyJ8Doj562FuNGlhlsdbC/lwU6Xf:idneJTZrq6XmZ8ZwEsMuNGl3OmSXf

Score

10^/10

hermit android banker collection discovery evasion persistence stealth trojan

Malware Config

Targets

- Target
  
  a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9
- Size
  
  1.1MB
- MD5
  
  6b69a9bf30d76c135db369956774f2cb
- SHA1
  
  22f49fa7fe1506d2639f08e9ae198e262396c052
- SHA256
  
  a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9
- SHA512
  
  2df561ffe8b9d8ce3ab6b1a5b1eccb4312e7230fa20c4da451e76cdb53e94169ffc4b2fbc0a09fe45ca6e5551921ba51670c087b0eb899ccc9206186ec0b83dd
- SSDEEP
  
  24576:idX3e1cFTNITHE4Uo+N6SSmZ1e8+wyJ8Doj562FuNGlhlsdbC/lwU6Xf:idneJTZrq6XmZ8ZwEsMuNGl3OmSXf
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

Privilege Escalation

Defense Evasion

Foreground Persistence

Hide Artifacts

Suppress Application Icon

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Location Tracking

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Location Tracking

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bankercollectiondiscoveryevasionpersistencestealthtrojan

behavioral2

bankercollectiondiscoveryevasionpersistencestealthtrojan

behavioral3

bankercollectiondiscoveryevasionpersistencestealthtrojan