8524c04a63ffb797e378aae715689c21d530711136ce3f0cbdd4f65ebd8c1216

Analysis

max time kernel
6s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/09/2026, 12:36

Target
ghost.bot.apk.v13.apk
Size 12.5MB
Sample260907-pterfavwaz
SHA256 8524c04a63ffb797e378aae715689c21d530711136ce3f0cbdd4f65ebd8c1216
MD5 03cc5a865501e6434eecabc1e640ead1
SHA1 40f5d11162737d848fdcffc5e0e45c153a928371
SHA512 7c379955029a76a390a895b9e49de7fcc0cac61dfe613304c90f28f9df0ca50e140b015df4b08e80472f94abd67eb753116545ec920d6226935a1809dc04987f
SSDEEP 196608:brjy6IrGxABG2ire+x7mi4kUQDrKIEQcs6EcZID6r1SlCObRUVieNU8k05zlUtG/:HZIMRE06EM2ayxtUVi8Uh08tG3PH
TLSH
T1BCD623AABF88ACEDC4F2463719B557A0113ADD2D86CBE7CB85D8707905B70C09E41ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
32	raw.githubusercontent.com
33	raw.githubusercontent.com

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact