General

  • Target

    build.s.apk

  • Size

    267KB

  • Sample

    250217-mfh6layjbw

  • MD5

    46fd7ae90adad17163e51191b3c3704a

  • SHA1

    1e111450b5b292d9d192513000f9ffb381709296

  • SHA256

    4d89afb5e33ae85630d73d0b3d9765f523b9e0b6e1e80e4ce50780ea486b8315

  • SHA512

    5acda92aa8ed43d8b5bb6f7861e08e138a4816cc7459faf5399e2b093fc5b9724101e25f25c7d9a3877386eb607ff9ae279156ebeae0227c5220019e42de100b

  • SSDEEP

    6144:AE+ohBRPxdh+0GohVa8g1wH9U75ENc7LNP900:AE+ofR119VXgGHyd9x

Malware Config

Extracted

Family

ahmyth

C2

http://192.168.0.133:22222

Targets

    • Target

      build.s.apk

    • Size

      267KB

    • MD5

      46fd7ae90adad17163e51191b3c3704a

    • SHA1

      1e111450b5b292d9d192513000f9ffb381709296

    • SHA256

      4d89afb5e33ae85630d73d0b3d9765f523b9e0b6e1e80e4ce50780ea486b8315

    • SHA512

      5acda92aa8ed43d8b5bb6f7861e08e138a4816cc7459faf5399e2b093fc5b9724101e25f25c7d9a3877386eb607ff9ae279156ebeae0227c5220019e42de100b

    • SSDEEP

      6144:AE+ohBRPxdh+0GohVa8g1wH9U75ENc7LNP900:AE+ofR119VXgGHyd9x

    • Removes its main activity from the application launcher

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Requests accessing notifications (often used to intercept notifications before users become aware).

MITRE ATT&CK Mobile v15

Tasks