9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385

Analysis

max time kernel
9s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
01-06-2024 22:59

Target

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385.apk
Size

4.7MB
MD5

250bb2e19a5201b2f94c58bade583a48
SHA1

16ed757e508f2b50319479ecadd09bb913b4fc48
SHA256

9a024d075aea9d1c68bdf27dbeed1c834f0831523f882a14ae0df0a5ffe7a385
SHA512

119dee2a72200bf65f9f835b60cb6e4f1b4e5ae9c188c51bdf3405adc082f46f43593a8bc089c8d99f1dc73b8f82c011c70525e8b77001009630747d7ea657fc
SSDEEP

98304:vB8IlBYuV0wIO3Ca9Vbley/tarfPh+zkYB3XWNTyqOEMK3jQ1:vf7FIO3mYt9q26Q1

Score

6^/10

impact

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 api.ipify.org
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.coalas.twiddlers

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.coalas.twiddlers

flow	ioc
23	api.ipify.org

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.coalas.twiddlers

com.coalas.twiddlers
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4655

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact