3d51aedc7a2dbc0b8dbbfd448b59cf19ed8363ebab123d4ef58e3dfe095c5e3a

Analysis

max time kernel
125s
max time network
149s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
09-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

i.apk
Size

3.9MB
MD5

72bad3bef6ee92412e4eda5cbfbc697e
SHA1

5fd49ffb15a64fc97557767fd82848432c36fb48
SHA256

d6cf5a3356359f59755b95c00394d3c41b992d1b52c5f25c6a8f759d9abdee08
SHA512

41e67b5b00e303d55ec0da960a8a96b2c1c6c1153805cdad12db8c703801fbe72b2a8c3415e2e9a4d233d24f4c0cf41e62908090bbe8213bf8a10b4632818330
SSDEEP

98304:GjtgxuG/UbOkN2uj1FDYZhk0mixcos+OF2ewCEPtqrXw46qa:GjtO3MNJDMkeSol02ewCIqM46qa

Score

7^/10

evasion impact persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.phosphated.bigler

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.phosphated.bigler
Acquires the wake lock 1 IoCs

Processes:

com.phosphated.bigler

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.phosphated.bigler
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.phosphated.bigler

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.phosphated.bigler

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.phosphated.bigler

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.phosphated.bigler

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.phosphated.bigler

com.phosphated.bigler
1⤵
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:5042

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads