e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc

Analysis

max time kernel
125s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
14-05-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc.apk
Size

3.7MB
MD5

74f63d7c8e51f07b83ddc0c09c009d92
SHA1

d005c80d45d759e9a550568f04dfb7d0df227627
SHA256

e0e5bace7224aff2e742b393b572f6de8c425b7deb2fa6397a7445d1127de1fc
SHA512

2c593406dbfb156144cf52db27f63dae48d297a8e010910301e2d3b9c79aa0a3d7df471d8e9130e2046f06bfe4e2710078482d093fb6c5c72c55418c67190402
SSDEEP

98304:nX65cXbElRY6Kt4EBPosjC/SbXIKekoUSWr:nX6aElRYW+PosjC/S8ITSWr

Score

7^/10

evasion impact persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.tasc.brucin

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.tasc.brucin
Acquires the wake lock 1 IoCs

Processes:

com.tasc.brucin

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.tasc.brucin
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.tasc.brucin

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tasc.brucin

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.tasc.brucin

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tasc.brucin

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tasc.brucin

com.tasc.brucin
1⤵
- Makes use of the framework's foreground persistence service
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4222

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads