17cf95ba7c320703392d85ade1c11f2d8c2d8d0bd02ff68e062450f1341c9ac0

Analysis

max time kernel
9s
max time network
160s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
01-06-2024 23:03

Target

17cf95ba7c320703392d85ade1c11f2d8c2d8d0bd02ff68e062450f1341c9ac0.apk
Size

4.7MB
MD5

a345903a787e8baf81dd928dd792b82c
SHA1

bb6b2eb4a372eed635b53e7e9ecc2db1c78b77b5
SHA256

17cf95ba7c320703392d85ade1c11f2d8c2d8d0bd02ff68e062450f1341c9ac0
SHA512

b3b888344e8ffa04be85e207f69ecb5b7656336f7d7469428630dcc3aed41086ea2023a41d7b623dc42734fde9fe1af41ec075e107f449d79a267b5e60bc9e5b
SSDEEP

98304:17pGxZ9t0bZ0KIHWlM1nedIod7d9hLMcm/rnEwzCw4zH5:1FGxZspIHWOwy+NQcSrnEwC7zH5

Score

6^/10

impact

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 api.ipify.org
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.verminicidal.sagittid

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.verminicidal.sagittid

flow	ioc
9	api.ipify.org

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.verminicidal.sagittid

com.verminicidal.sagittid
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4242

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact