General

  • Target

    L3MON.apk

  • Size

    267KB

  • Sample

    240920-rw3mds1hqm

  • MD5

    02c5d2f5e7514119e45a57a9f40e4eb5

  • SHA1

    8275721db1cdc1284088ccf9103f6dfe3eedeef6

  • SHA256

    afee80131c638670683839587e2962362b68b90656ad3c9d0da198346814b3f7

  • SHA512

    6403de5a22e446a1921e8fa2a7d6fc8075b06d49df0cee49a5710fb2bf50fbc4c9902dc122da70ea69fbcb622a8e56efa1ccfd8249a511df502a83d54f33cdda

  • SSDEEP

    6144:PEKq8qo+Gb9A3iNvKzHDpb/Z8YZesN0Vij5aLSHKJEGNP90t:PEr8P++KeKz1ZVMsjjoLRB94

Malware Config

Extracted

Family

ahmyth

C2

http://192.168.1.192:2233

Targets

    • Target

      L3MON.apk

    • Size

      267KB

    • MD5

      02c5d2f5e7514119e45a57a9f40e4eb5

    • SHA1

      8275721db1cdc1284088ccf9103f6dfe3eedeef6

    • SHA256

      afee80131c638670683839587e2962362b68b90656ad3c9d0da198346814b3f7

    • SHA512

      6403de5a22e446a1921e8fa2a7d6fc8075b06d49df0cee49a5710fb2bf50fbc4c9902dc122da70ea69fbcb622a8e56efa1ccfd8249a511df502a83d54f33cdda

    • SSDEEP

      6144:PEKq8qo+Gb9A3iNvKzHDpb/Z8YZesN0Vij5aLSHKJEGNP90t:PEr8P++KeKz1ZVMsjjoLRB94

    • Removes its main activity from the application launcher

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Requests accessing notifications (often used to intercept notifications before users become aware).

MITRE ATT&CK Mobile v15

Tasks