Hermit
Malware family · 1 sample(s) · 1 indicator record(s) · 1 signing certificate(s)
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| vodaservices-70020.firebaseio.com | domain | a98a224b644d… | 2018-10-29 |
Detected samples without extractable endpoint (7)
Family matched by code marker or hash attribution, but no C2 is statically extractable — the endpoint arrives at runtime.
| SHA-256 | Package | Note | First seen |
|---|---|---|---|
| 0759a60e0971… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2021-05-17 |
| 243ea96b2f8f… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-04-23 |
| 6eeb683ee467… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2021-10-18 |
| 8ef40f13c619… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2021-02-11 |
| 9146e0ede1c0… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-04-04 |
| e38d7ba21a48… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-04-23 |
| fe95855691ca… | — | Hermit (RCS Lab / Tykelab) lawful-intercept spyware. Poses as telecom/support apps and loads modular payloads from C2 after anti-analysis checks. Config params: vps (cert-fp:ip:port), vpsseed, psk (HMAC); native agent libvoid*.so; RSA pk shipped as assets/hianalytics_njjn. source | 2022-05-27 |