General

  • Target

    2b62153c7b521049da195360f2b1669aa05d3a3f0ab1223de5ca539476e77d1d.apk

  • Size

    53.2MB

  • Sample

    240905-bk3j9a1dnd

  • MD5

    7f4e489b50228cabb03a30f180957b98

  • SHA1

    20c8153d59d167e9cfbca63560daa29c3e24222b

  • SHA256

    2b62153c7b521049da195360f2b1669aa05d3a3f0ab1223de5ca539476e77d1d

  • SHA512

    c7591db0338fcb1de4822aa14427bef88f2712f2d19a7b2dac8d4af6b7b6737069ef180650d9ee48f75359441368307080a5a8a54d9beeaedc39770b4e5277c4

  • SSDEEP

    1572864:0CssSAeIYH2xWJCCsXd+f8imh70Yb2ajg:0CssSAG+dYTC2aU

Malware Config

Extracted

Family

ahmyth

C2

http://open.weixin.qq.com/connect/sdk/qrconnect?appid=%s&noncestr=%s&timestamp=%s&scope=%s&signature=%s

Targets

    • Target

      2b62153c7b521049da195360f2b1669aa05d3a3f0ab1223de5ca539476e77d1d.apk

    • Size

      53.2MB

    • MD5

      7f4e489b50228cabb03a30f180957b98

    • SHA1

      20c8153d59d167e9cfbca63560daa29c3e24222b

    • SHA256

      2b62153c7b521049da195360f2b1669aa05d3a3f0ab1223de5ca539476e77d1d

    • SHA512

      c7591db0338fcb1de4822aa14427bef88f2712f2d19a7b2dac8d4af6b7b6737069ef180650d9ee48f75359441368307080a5a8a54d9beeaedc39770b4e5277c4

    • SSDEEP

      1572864:0CssSAeIYH2xWJCCsXd+f8imh70Yb2ajg:0CssSAG+dYTC2aU

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Reads the content of photos stored on the user's device.

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Requests cell location

      Uses Android APIs to to get current cell information.

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks