Analysis
- max time kernel
47s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
01/07/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bajilive999.apk
Resource
android-x86-arm-20260325-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bajilive999.apk
Resource
android-x64-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
bajilive999.apk
Resource
android-x64-arm64-20260325-en
3 signatures
150 seconds
General
- Target bajilive999.apk
- Size 492KB
- Sample260701-apw3lacz21
- SHA256 9dd0a435e16d71af032e35690d47f9251887e20362d0b98a0b5f950bba1f5004
- MD5 81d74cf21d3bf562adf82eeb58a4173f
- SHA1 c33e08481c99035c69a7061ad77325196205ac79
- SHA512 b7645ca551e711a43ca5cd035e877fc2d24401cc11366eaea07a591ddff91ec58338cb45f2c7e269deb7feadb1030a281b842352f7ee70052952ce75d03901de
- SSDEEP 12288:Lj0dbw2Q2aj0dbw2Q2jj0dbw2Q2/j0dbw2Q2qj0dbw2Q2K:cdZQ2TdZQ20dZQ2gdZQ2jdZQ2K
- TLSH T19DB4027A716D0544E77C267E1E41ADF35067ECA0A32F24B56108E56CB73A7FBB024788
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.bajilive999.bajilive999 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.bajilive999.bajilive999 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.bajilive999.bajilive999 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.bajilive999.bajilive999 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.bajilive999.bajilive999