TF-MAL-apk.ahmyth
📛 Threat Title
Malware family: AhMyth
Description
ThreatFox malware family `apk.ahmyth`. Printable name: AhMyth.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.ahmyth
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.ahmyth
IOC database
- Type
- domain
- Value
apk.ahmyth- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.ahmyth
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.ahmyth
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:deepwiki.com
Client Setup and Configuration Relevant source files Purpose and Scope This document details the setup and configuration processes for the AhMyth Android client component, which is the malware payload that runs on victim devices. This page covers the client architecture, configuration parameters, and the process for preparing the client for deployment. For information about the client's ...
-
web:dev.to
As 2025 closes, the landscape of mobile security testing and research tools has undergone a seismic shift. Tools once considered staples—like AhMyth , SpyNote, Cerberus, and Spymax—are now largely ineffective against modern Android defenses like Google Play Protect's 2025 behavioral analysis and hardware-backed keystores.
-
web:github.com
AhMyth has 6 repositories available. Follow their code on GitHub.
-
web:hackmag.com
AhMyth RAT (Remote Access Trojan) is an open-source application currently in beta. It's primarily geared toward Windows users, but you can also find source code for Unix-like platforms on GitHub. AhMyth RAT consists of two components. A server-side application used to control a compromised device and generate APK files with malicious code.
-
web:malpedia.caad.fkie.fraunhofer.de
According to PCrisk, Ahmyth is a Remote Access Trojan (RAT) targeting Android users. It is distributed via trojanized (fake) applications. Ahmyth RAT steals cryptocurrency and banking credentials, 2FA codes, lock screen passcodes, and captures screenshots.
-
web:securityscorecard.com
The malicious application is based on the open-source Android RAT called AhMyth . The following commands are implemented: taking pictures, exfiltrating phone call logs and phone contacts, stealing files and SMS messages from the phone, tracking the device's location, recording audio, and sending SMS messages.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family . The page below gives you an overview on indicators of compromise associated with apk. ahmyth . You can also get this data through the ThreatFox API. Database Entry
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.pcrisk.com
What kind of malware is Ahmyth ? Ahmyth is a Remote Access Trojan (RAT) targeting Android users. It is distributed via trojanized (fake) applications. Ahmyth RAT steals cryptocurrency and banking credentials, 2FA codes, lock screen passcodes, and captures screenshots. Ahmyth in detail Ahmyth steals cryptocurrency and banking accounts using its keylogging and credential theft capabilities. The ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.