b15ae5265b825461da1bc334313377d1e997955db614889afaab5c9a7f1a9495

Analysis

max time kernel
9s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
29-06-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adliran.apk
Size

2.7MB
MD5

50fc09fb31e061f807af204c0c8dc9a6
SHA1

db528e79afccd632370148f9c393f987fa623586
SHA256

b15ae5265b825461da1bc334313377d1e997955db614889afaab5c9a7f1a9495
SHA512

672843406a6c1e770cc54e72e6f780bed320f7f07a9de1153374c515fbf6bad177a32d2a3a0a6b50554e8a2c50438241b145fd99e1c4405db7a17f1e46ff59f4
SSDEEP

49152:2XccGsAkkZlmDWDBmcagPLslKhLzmJMVtEQ7skbLshAu7RQKdrr0jJVTs5AA6pEP:2XakkzmDWDBmcaGH2CFAMLshRmYrojJ4

Score

6^/10

discovery impact

Malware Config

Signatures

Acquires the wake lock 1 IoCs

Processes:

com.temptation.lydia

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.temptation.lydia
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.temptation.lydia

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.temptation.lydia
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.temptation.lydia

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.temptation.lydia

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.temptation.lydia

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.temptation.lydia

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.temptation.lydia

com.temptation.lydia
1⤵
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4628

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.temptation.lydia/files/PersistedInstallation4166929600506489003tmp

Filesize
564B

MD5
7b99826fe75da951c0f3ba095064a628

SHA1
6120fbd5e9b238eac37ee12f2ce962fabc089e3f

SHA256
1cb17a8abd256a62940afe4468626ae01b676a011ebf559ef064aa1f414e0b20

SHA512
925fb1f8b2e2843164e525b9ae48d701e93040c576c34cad0f3f15cf9ff47409b680b0ba5487ee853761ec0eb4d91bd177eae2a913c00d17d2992cc992b78e4d

Download Submit
/data/data/com.temptation.lydia/files/PersistedInstallation4289178214592196405tmp

Filesize
90B

MD5
5198444e11c378d8113f088f64ddf3d5

SHA1
d1358fef98b72ae1be866aae7718540095f39552

SHA256
7a80933cf0261dfce29978373c6db495b10e2c95ca75ed1ede1de52eca86f2aa

SHA512
6cc06104b094804f6211fe49c90a6dd6b35a024fbc1f25cdee5df51b30ccceb784604283d0692824f2c5a2957459d55b9660cec25be716dd6076927076465321

Download Submit