80e4e816e1b0236e8b431b6586768e0a2be741a45850435575f9f30925a1adc8

Analysis

max time kernel
149s
max time network
158s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
12-10-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80e4e816e1b0236e8b431b6586768e0a2be741a45850435575f9f30925a1adc8.apk
Size

4.0MB
MD5

e8eedd5a5377a2f4f59bdb586042c508
SHA1

b9a11a3ef9517e8670538a1cf036bbe020961f5a
SHA256

80e4e816e1b0236e8b431b6586768e0a2be741a45850435575f9f30925a1adc8
SHA512

1402fe6abe3d39fd961866a90bafa16de8765582039ddc50f19dd8a922bc4e7c859e85c1bd33886e930e7d7bf877f0179a440991d5c91034103c430c0b352a4e
SSDEEP

98304:2qYg6sA2kZye3PgcE39b2gQlmLDOLqSm3nEPF1ljrro:25nsnkQy3lmLDOLq92F1e

Score

6^/10

discovery evasion

Malware Config

Signatures

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	bai.shan.shui

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	bai.shan.shui

bai.shan.shui
1⤵
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4497

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/bai.shan.shui/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit