Hermit
Malware family · 1 sample(s) · 1 indicator record(s) · 1 signing certificate(s) · Active 2018-10-29 → 2022-05-27 (experimental)
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| vodaservices-70020.firebaseio.com | domain | a98a224b644d… | 2018-10-29 |
Detected samples without extractable endpoint (7)
Family matched by code marker or hash attribution, but no C2 is statically extractable - the endpoint arrives at runtime.
| SHA-256 | Package | Note | First seen |
|---|---|---|---|
| 0759a60e09710321dfc42b09518516398785f60e150012d15be88bbb2ea788db | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2021-05-17 |
| 243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-04-23 |
| 6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2021-10-18 |
| 8ef40f13c6192bd8defa7ac0b54ce2454e71b55867bdafc51ecb714d02abfd1a | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2021-02-11 |
| 9146e0ede1c0e9014341ef0859ca62d230bea5d6535d800591a796e8dfe1dff9 | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-04-04 |
| e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3 | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-04-23 |
| fe95855691cada4493641bc4f01eb00c670c002166d6591fe38073dd0ea1d001 | - | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-05-27 |