f8dea4cd9c869a5d35c613f2e0beabbc724fb2d61b4a9909d9b08e26844fc952

Analysis

max time kernel
13s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
15/06/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8dea4cd9c869a5d35c613f2e0beabbc724fb2d61b4a9909d9b08e26844fc952.apk
Size 4.1MB
Sample240615-c8a1kswhmd
SHA256 f8dea4cd9c869a5d35c613f2e0beabbc724fb2d61b4a9909d9b08e26844fc952
MD5 b96ae1bc59107140e911d3fb3561f9ab
SHA1 f2c6e5d3466424559df6075e39c7698b6b033031
SHA512 0be4d842b89590255be121ffe1438cac5a29eaac1abbe38931b53ea0a30b8076900ccd86938386f5a528d8e9398ced80e6470e0b344afefc3e87a866bf8a9f78
SSDEEP 98304:LloAQeVrmihTeYpxkkAO00jSxe3uvJqaC+bZoiuBVdlqRl1Hvc7Xk:Llee1pTeG7jSxe3uTbZoiUdAR/Hvc70
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery impact

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.bax.project

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.bax.project

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	org.bax.project

org.bax.project
1⤵
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4439

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation7014875938808349909tmp

Path /data/data/org.bax.project/files/PersistedInstallation7014875938808349909tmp
Size 569B
SHA256 f1b3f41285da43c310eed08eacf1bde386a14d5f0113fa2af63732fbbd88b8a7
MD5 e5fd9b5689e09550b33b5487082045af
SHA1 0d491ec0f536cf4193b907942e16da21ed681bf4
SHA512 7cacf518daf4784cf29194d6eda580cb55570a5e3e452f0d68e182abd688d76a76dfd7f5face1e2032ea17911984f9871ef7527d146f8cd2a7c400e217e85f25
MD5 SHA1 SHA512

Submit Download

PersistedInstallation702363280344275725tmp

Path /data/data/org.bax.project/files/PersistedInstallation702363280344275725tmp
Size 90B
SHA256 e070fd52572044640d27461d235c99c313d7a800891f8b8ae39d4e4e1728f6b6
MD5 35baac1a1ebd152f8b936f26cbe314ab
SHA1 c8b0e841a906b02540fb886c11eded603bba8914
SHA512 699981ee000e966bbe190ee1bcae17a82ef6a7f27272fd7fbaf69b7c128386cd6331eafbaf815698beb1b83bcdaba825d1a903b63262180465861c96a5df29d4
MD5 SHA1 SHA512