General

  • Target

    ROPanel-FF-v4.apk

  • Size

    37.4MB

  • Sample

    250327-h7z6zayvfx

  • MD5

    848920df47508f0316be22ac51ac88e5

  • SHA1

    44c65cb043c4485e6fedb1123a2ab0f11c24b8d8

  • SHA256

    7daef80bc7cd3ec6303ffd1e07d06982431b2c29685fbf9f95367a9ad4521b2f

  • SHA512

    dcc1ef0559e7c7c01ba4b5e3d87f7cbac9ec2a113761c2d0bd081d8834f71fa809d27857c2d64735769c093b2e4137f5aa23547c977bb0ae53dd01c855674f23

  • SSDEEP

    786432:MHVEVNWex9coTFuIPFd1VDUCBITOMWePBy4yUCXJ6PwCBL7n4x9G/d54:WEHRx2oMAd1VNpMWePByjJ6Pfnn47454

Malware Config

Extracted

Family

ahmyth

C2

http://147.185.221.17:25603

Targets

    • Target

      ROPanel-FF-v4.apk

    • Size

      37.4MB

    • MD5

      848920df47508f0316be22ac51ac88e5

    • SHA1

      44c65cb043c4485e6fedb1123a2ab0f11c24b8d8

    • SHA256

      7daef80bc7cd3ec6303ffd1e07d06982431b2c29685fbf9f95367a9ad4521b2f

    • SHA512

      dcc1ef0559e7c7c01ba4b5e3d87f7cbac9ec2a113761c2d0bd081d8834f71fa809d27857c2d64735769c093b2e4137f5aa23547c977bb0ae53dd01c855674f23

    • SSDEEP

      786432:MHVEVNWex9coTFuIPFd1VDUCBITOMWePBy4yUCXJ6PwCBL7n4x9G/d54:WEHRx2oMAd1VNpMWePByjJ6Pfnn47454

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Reads the contacts stored on the device.

    • Reads the content of SMS inbox messages.

    • Reads the content of the call log.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

MITRE ATT&CK Mobile v15

Tasks