b15ae5265b825461da1bc334313377d1e997955db614889afaab5c9a7f1a9495

Analysis

max time kernel
8s
max time network
135s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
29-06-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adliran.apk
Size

2.7MB
MD5

50fc09fb31e061f807af204c0c8dc9a6
SHA1

db528e79afccd632370148f9c393f987fa623586
SHA256

b15ae5265b825461da1bc334313377d1e997955db614889afaab5c9a7f1a9495
SHA512

672843406a6c1e770cc54e72e6f780bed320f7f07a9de1153374c515fbf6bad177a32d2a3a0a6b50554e8a2c50438241b145fd99e1c4405db7a17f1e46ff59f4
SSDEEP

49152:2XccGsAkkZlmDWDBmcagPLslKhLzmJMVtEQ7skbLshAu7RQKdrr0jJVTs5AA6pEP:2XakkzmDWDBmcaGH2CFAMLshRmYrojJ4

Score

6^/10

discovery impact

Malware Config

Signatures

Acquires the wake lock 1 IoCs

Processes:

com.temptation.lydia

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.temptation.lydia
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.temptation.lydia

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.temptation.lydia
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.temptation.lydia

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.temptation.lydia

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.temptation.lydia

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.temptation.lydia

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.temptation.lydia

com.temptation.lydia
1⤵
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4246

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.temptation.lydia/files/PersistedInstallation8726031780042889832tmp

Filesize
90B

MD5
f6c2be0e7b053393e9688acadd8e930f

SHA1
55edcb4d5755da9f585f84f56957092e2d916e4e

SHA256
3701791328400af2d04594991e6425c3b8645ba56b860da717e3728d37729989

SHA512
5ed90ec61bbad84ff8bd4c42aa9be49782cbb5e3660bdd63f2eefd590c1bc3d09cf6bdce36d5ce9a3377085cedd8f4084061e95a343c55c38d625df7ea9affff

Download Submit