hermit | e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3

General

Target

e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3
Size

2.9MB
Sample

240410-rxfh9abc97
MD5

db253c49fa9375e6eaa7f23661c58554
SHA1

527141e1ee5d76b55b7c7640f7dcf222cb93e010
SHA256

e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3
SHA512

e15c29a45813977896487240692c5286053ca4e63f8da92709e4ea56ec354a039fcd5fe8168076da9d2e718cd89704e117e4ea690f5102383253f94f24ac362d
SSDEEP

49152:3wAIKVFQuVh59r9VWEOxeoRPipEauRMQ7QqyGdZEdyqDVNdo:3LTH9rXxOxnuETQL5zDV7o

Score

10^/10

Malware Config

Targets

- Target
  
  e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3
- Size
  
  2.9MB
- MD5
  
  db253c49fa9375e6eaa7f23661c58554
- SHA1
  
  527141e1ee5d76b55b7c7640f7dcf222cb93e010
- SHA256
  
  e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3
- SHA512
  
  e15c29a45813977896487240692c5286053ca4e63f8da92709e4ea56ec354a039fcd5fe8168076da9d2e718cd89704e117e4ea690f5102383253f94f24ac362d
- SSDEEP
  
  49152:3wAIKVFQuVh59r9VWEOxeoRPipEauRMQ7QqyGdZEdyqDVNdo:3LTH9rXxOxnuETQL5zDV7o
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device.
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2