Resubmissions

05-11-2024 06:08

241105-gvw34symfm 10

04-11-2024 15:54

241104-tcatdavnhr 10

01-11-2024 19:45

241101-ygb98aspew 10

28-10-2024 06:09

241028-gwyy4azmbr 10

27-10-2024 22:07

241027-11wt3s1mem 10

Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    28-10-2024 06:09

General

  • Target

    11d926b4e7068914d27200e1aebcbc5e255088ae588a50a1f8f0520771bb6b15.apk

  • Size

    4.5MB

  • MD5

    4295dfdd9d9fad74ee08d48d13e2b856

  • SHA1

    526d4db2c11f33d24ca4ec727ac119c677e46b52

  • SHA256

    11d926b4e7068914d27200e1aebcbc5e255088ae588a50a1f8f0520771bb6b15

  • SHA512

    07b80e9e1db7f811fb2c97dc1b1df9cceb8c3f752ad1d39f4aaa41df01123170b5deacb28902c3ebfa66804ab8782dd8a3ce8e8ab129c4d907deced43698581e

  • SSDEEP

    98304:cjQ2sNAKHdW7C7LMD4747C56myn92vuXCNBPZqnAejSyB4Lb20B:cjj7C7LH74+56hn9FyNgSyr0B

Malware Config

Signatures

  • TgToxic

    TgToxic is an Android banking trojan first seen in July 2022.

  • TgToxic payload 1 IoCs
  • Tgtoxic family
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 10 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.example.mysoul
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Reads the content of photos stored on the user's device.
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4537

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.example.mysoul/app_judge/pyai.json

    Filesize

    1.5MB

    MD5

    4264325070d7f21b11eff78f3b168465

    SHA1

    a848ebc8150caab12b2b229781aef05a6bb30057

    SHA256

    ee129600b0da127afffd8795d318751d345301d3a4d2475b594f50bbe07c1666

    SHA512

    f77c99af9a95498026ecc2f8b1f2925e8699370c48cbe88d3576d95c99d7689fc7f2109f99c15f33a6c38c6c7db339ff8eb10032e169f016b87227bb07364e8e

  • /data/data/com.example.mysoul/app_judge/pyai.json

    Filesize

    1.5MB

    MD5

    46b58e24a61a7a5b759c0989b8580e98

    SHA1

    57f3a2f49f6b240af643d59b27fbea498b460a43

    SHA256

    6ceaf8a1dadaf56801eef8aba7c50941099b7abf9f34dac1d7f844b7a03d2dc2

    SHA512

    3a2f2ecc4672827da8f3e7af1ceec06fe3bba5dbdf6b0cf5c7f48c44da83b962f0bd54b9888774322326776c61ff42463cbe43c292d507200841206a9f7e2f17

  • /data/data/com.example.mysoul/cache/sb114399039466830613362.mp3

    Filesize

    940B

    MD5

    fd42b38a64ffb153df0fc0d1cedf780f

    SHA1

    21ab32c80465f7f1a760bedf4782a6292220f31a

    SHA256

    b5d7217edaf72ae337e805c1cf70cf5d4697e2c62a1c7d2ec51e78b5399927ba

    SHA512

    916026ce46e5b40bc5bf9b6705c4160d87a432e533ee8490d8f2013c114d85eab3bfa4f0f621c2e658c20fe377cd12f470ee0162ee64831322c237de6d1bd7f9

  • /data/user/0/com.example.mysoul/app_judge/pyai.json

    Filesize

    3.4MB

    MD5

    1ef35068c2219a60eaf997eb30fc80a3

    SHA1

    4b93bb6b12d1fcf8aff67df3269e280438ce0588

    SHA256

    42a8314562b8e32ad4aff7a65d6eedec79b599d767f731cc4947678f8cffaad2

    SHA512

    9ff5ff4fd5489ad5862428a39f92bfd27e8b852a70c45ff06d506fabd95b081420bcf60ba158ad44d439d2f7e78e6e1ccad2f63f26edc99f62fa4566654f8b46