d4fddc345aea69f08c1182cfb58fae06a414876bc8a579162783c67c0178d054

Analysis

max time kernel
12s
max time network
169s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
12-04-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HEUR-Backdoor.AndroidOS.Ahmyth.apk
Size

293KB
MD5

15d871c35eff08519a7463456229939c
SHA1

f790c0f4fb971fdba89c1c19d6165fb1ccf31a6c
SHA256

d4fddc345aea69f08c1182cfb58fae06a414876bc8a579162783c67c0178d054
SHA512

86fc8d13bef39cc1e0eb807447aa6a70b4d8942c1e9cdb5485746ebe08918bb4daa163dd8e6b7f07145bc94dbc2bfd4c22a4eb2de93df7e4f8bae4ed0d07ee6e
SSDEEP

6144:PX3PWxohsFdpR5+5rgaVJQLGDPPkbHfIq:PnuuhOegPiDHAt

Score

7^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	ahmyth.mine.king.ahmyth

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	ahmyth.mine.king.ahmyth

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
24	0.tcp.eu.ngrok.io
46	0.tcp.eu.ngrok.io
62	0.tcp.eu.ngrok.io

ahmyth.mine.king.ahmyth
1⤵
- Makes use of the framework's foreground persistence service
- Tries to add a device administrator.
PID:4435

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads