05373db5a137db1a51131fdc8f1fef981b7c504e816cbf76cb06a7b02f8f66d0

Analysis

max time kernel
8s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
14-05-2024 22:03

Target

05373db5a137db1a51131fdc8f1fef981b7c504e816cbf76cb06a7b02f8f66d0.apk
Size

4.7MB
MD5

6ac64c45280441ae30299b1fcf951a55
SHA1

59602192d0ed3a84b577dc7adbb1911a36b44980
SHA256

05373db5a137db1a51131fdc8f1fef981b7c504e816cbf76cb06a7b02f8f66d0
SHA512

e133e15b0569b82f50ce54f69a672753623e660f086b6f265bbef5da81b07f04e15a028a13b3670800d7cba96e9941326a59eb24424082db447a93ef1e49c460
SSDEEP

98304:ZwZa90v+A03qwv9h2UZmBiImbiQdDMqQAChwzvT7idW7E3:6+jJ2LBioqDMqQAChw/No3

Score

6^/10

impact

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.ipify.org
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.guigne.barbless

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.guigne.barbless

flow	ioc
8	api.ipify.org

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.guigne.barbless

com.guigne.barbless
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4490

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact