36f40d5a11d886a2280c57859cd5f22de2d78c87dcdb52ea601089745eeee494

Analysis

max time kernel
778s
max time network
704s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
28-06-2024 23:56

Target

36f40d5a11d886a2280c57859cd5f22de2d78c87dcdb52ea601089745eeee494.apk
Size

2.0MB
MD5

8ce42ae8f1206130aeadaa7cad062aca
SHA1

ca2e7c66b9eedf95f51204cea8cd2e13ba2a5d93
SHA256

36f40d5a11d886a2280c57859cd5f22de2d78c87dcdb52ea601089745eeee494
SHA512

e7c135a6addd21c26862808eecdc0c1e86f5c667eb000257764be9180982a50da14e18c0e36dfdf143e93f041ab481cbe9b2e39f6f4c3003a666db0bf89ddba9
SSDEEP

49152:q7PtjuZTUx4vhFm8ynE8F4+jVlWC6ec8RwWwUjtZ:SP1uZTpDm8yn549C6J0wWB

Score

8^/10

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.android.tencent.zdevs.bah

pid process

4469 com.android.tencent.zdevs.bah
Changes the wallpaper (common with ransomware activity) 1 IoCs
ransomware

Processes:

com.android.tencent.zdevs.bah

description ioc process

Framework service call android.app.IWallpaperManager.setWallpaper com.android.tencent.zdevs.bah

pid	process
4469	com.android.tencent.zdevs.bah

description	ioc	process
Framework service call	android.app.IWallpaperManager.setWallpaper	com.android.tencent.zdevs.bah

com.android.tencent.zdevs.bah
1⤵
- Removes its main activity from the application launcher
- Changes the wallpaper (common with ransomware activity)
PID:4469

/data/system/users/0/wallpaper_orig
Filesize
307KB

MD5
0bc1d91b498943c8c869953e4a7cd520

SHA1
b4b46e3bfe914fe75f2e358637eb624d3945d38b

SHA256
a1a8d601c9f63a1ef2f187bce5f23c78dbbdbc9b42f12825d816a2097d3bb08a

SHA512
e0d9985e61705c3dc92846d27e656b2e790bd9b57edc39b11a445d14491ce1b1e746cdd789b670f8331d93218eb04eb74b9f6d19535793ea744c9f713135f466

Download Submit