6b43b4e65a9174612a62c66071637505e0e85424a595ea5379f42e9937c88f82

Analysis

max time kernel
2s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
22/09/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6b43b4e65a9174612a62c66071637505e0e85424a595ea5379f42e9937c88f82.apk
Size 3.0MB
Sample260922-qd4lasfa85
SHA256 6b43b4e65a9174612a62c66071637505e0e85424a595ea5379f42e9937c88f82
MD5 e8b98578e3a24ee3e6caa8f511bab650
SHA1 f125dd4f995eced16fbea517fcd5717bbced051c
SHA512 c44bc0885debb4edbe9612dbbbdff2a8e8d4be0e808710fe26f6168c3a03c1074e7fbb3d7227e1c9af75c0d3fa5179ac254fab5de765799493562e3a8a32bfac
SSDEEP 49152:u9lNrENUn/4cGv8TXRTI3XXmn2TFaoz7U7nQmRP+CRMLuLi1FKbgf4Z0B0x1Q6Rz:u3NwNOfGSXO3XXDgoPpYnMLuu1Mj0B0L
TLSH
T1E9E53385A9F7FC24D6F24439E0C9E07B641E83365C0BF6371A51849FAAE6D091B0DED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery impact

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lydia.route

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lydia.route

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lydia.route

com.lydia.route
1⤵
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4766

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation7840367431381420457tmp

Path /data/user/0/com.lydia.route/files/PersistedInstallation7840367431381420457tmp
Size 90B
SHA256 b27fe70fc943224543b061141c4ac2a1d57737541eea6d4888be626b196797eb
MD5 c09e7a7b8d7621bc8a95d26735c4520f
SHA1 65e18d03c205d43233f9d57eec1c0d623a3be50f
SHA512 da91db49e4ce3db2bc9381a334fe1c9bb9778297a3e60ebb3fb2a00d683cdb52455fd3d44c76344305c8509639cb9d37cd2769198679356c5f880c93c03c0f23
TLSH
T1E3B012814A318345C899B2072E8C91002DD03845140DCE058A5DA85040C11E081039E8
MD5 SHA1 SHA512 TLSH

Submit Download