ahmyth | e04091536edb7670381cd07dd4a5c500d27e078053b4f9e0ad314becdd70d87c

Analysis

max time kernel
204s
max time network
289s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
09/04/2025, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff.html
Size

7KB
MD5

feee8385904c56c40c09d6a57cb37482
SHA1

9f1e8332feed2d74a51c9731db3669a3c4db4643
SHA256

e04091536edb7670381cd07dd4a5c500d27e078053b4f9e0ad314becdd70d87c
SHA512

44e39dcf334a1eff3c9d7d6a3f86035094db847322e7c5ae622708045fab6bff3ac0fd836dd25489f8090b0d2227b944dbeae1649f8d9194cd2cfadc26fdff37
SSDEEP

96:OfWVTg693p1A7IewHFwyJgOHgQ8Bs1EszU/vifEviDMD:+mU693p1A7powyJBAQ8rHikiDMD

Score

10^/10

ahmyth infostealer rat trojan

Malware Config

Extracted

Family

ahmyth

http://147.185.221.17:25603

Signatures

AhMyth
AhMyth is an open source Android remote administration tool.
trojan infostealer rat ahmyth
Ahmyth family
ahmyth

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
18	raw.githubusercontent.com
14	raw.githubusercontent.com

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4394

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Download/.pending-1744787589-ROPanel-FF-v4.apk

Filesize
2.2MB

MD5
1008b7445113697d62505b314f01635d

SHA1
e20c9e16149ea5dbeea5fb1a22eb536ac2d63b08

SHA256
8a35bbe17fc5c8cdf6e7c7dc5cb9e5248637e43b9d770bfc92e36d7d8b61e4b0

SHA512
d3548bfbf428a704ad44331ba2f4326cf0262df8b184efd34162fa7864349fd9ea5bb2408a9fd9eba73870239ae08b8ff55118adcd751d528d768392c7153a96

Download Submit
/storage/emulated/0/Download/.pending-1744787589-ROPanel-FF-v4.apk

Filesize
37.4MB

MD5
09e194d4198223fd04b88cc1544e5127

SHA1
269ae188f93eb940b5c50a053e1c8db06a65c153

SHA256
675cbcc8aff16445efbd7c08097eec01d88c9c4f0baaed69baf6f8e80382a4be

SHA512
f758968f3aa9036e50491d9ea8afd13064ff813933b33139808636b7c4fdb15326112fcbca522c9dc0ed87fd5ea238bd80d88eae1def89a9b83bbf3d8f8b43f7

Download Submit
/storage/emulated/0/Download/.pending-1744787589-ROPanel-FF-v4.apk (deleted)

Filesize
544KB

MD5
3b3813152fa2bb50f9ad10e3cfbc7794

SHA1
3901469a56667580d818c12bf47cdbbbd0fd1003

SHA256
dd551083400888ccfffb89ccb9bc1db5fe676d8dc367c2762184c15359694687

SHA512
70781bc3518b898623223b3568c00e815fcb8483a2d8858e6e6c4a84eea32d2cede21c8ec94e78a7cc0c75b6b6d4aa4f3df27fe6722770648ed4b8e4bb01a0a9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads