Analysis
-
max time kernel
299s -
max time network
302s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
28-10-2024 06:33
General
-
Target
Chrome.apk
-
Size
5.1MB
-
MD5
f5c44a7044572e39e8fb9fa8e1780924
-
SHA1
87486ddaf16cad28976840ddab1021d3b2035b24
-
SHA256
158bfa63e745e4d5b05f2c63fca5a002c3080843d0b814b6497b150e4bb5f43e
-
SHA512
665e602b4c1d3f7dc503c602579bc3957df83d5c9008ab16fc84fdcdab357648f8bc5cea07793851c57ab7f82fdb8bfe7f9d8e977c4e9759e7be47db1e6e9da0
-
SSDEEP
98304:3/hC2sNAKHdW7C2AdkJk0niOxLVtBxN7HU3lvLNalYsYTbuoGObH:3//7C2GkfhpNN7H+xalFubH
Malware Config
Signatures
-
TgToxic
TgToxic is an Android banking trojan first seen in July 2022.
-
TgToxic payload 1 IoCs
-
Tgtoxic family
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 17 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 6 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 6 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 6 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network 1 TTPs 6 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 6 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 6 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
-
com.example.mysoul1⤵
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5dc801bf84b9bbb4681cb03fdd4fc56e4
SHA179b3036da2cc255568acf59cfe072e12f8e4a1c2
SHA25625bfa15c370a8d0d599acb5ca916537901de8e0f4816d2e8d52461fd43fb0042
SHA51221cbdd17e50f2f08eeba9073e8e9547b298f2e9e52622a7c402b454c7bc85faeebf5b7b5573f05d55e4192d99a5a203115bded45285fe6760f32edcc1aa46136
-
Filesize
1.5MB
MD568daa784a5115925c2b01a283b9227e1
SHA1159bfaadd7dc7cc71da323d9a1490db3e02064ad
SHA25683be0926bb484b9a89fff73f736e319bf4339c5c416fcab10658ffad02b9e11f
SHA51200b581adbaaaa2affe88b258512e1b160eb18fd04d32b259801970f2370a6d70cefa6f53a36a11e787efa8579bae530a129a8ef07f686c453c311c167017e726
-
Filesize
940B
MD5fd42b38a64ffb153df0fc0d1cedf780f
SHA121ab32c80465f7f1a760bedf4782a6292220f31a
SHA256b5d7217edaf72ae337e805c1cf70cf5d4697e2c62a1c7d2ec51e78b5399927ba
SHA512916026ce46e5b40bc5bf9b6705c4160d87a432e533ee8490d8f2013c114d85eab3bfa4f0f621c2e658c20fe377cd12f470ee0162ee64831322c237de6d1bd7f9
-
Filesize
3.4MB
MD51ef35068c2219a60eaf997eb30fc80a3
SHA14b93bb6b12d1fcf8aff67df3269e280438ce0588
SHA25642a8314562b8e32ad4aff7a65d6eedec79b599d767f731cc4947678f8cffaad2
SHA5129ff5ff4fd5489ad5862428a39f92bfd27e8b852a70c45ff06d506fabd95b081420bcf60ba158ad44d439d2f7e78e6e1ccad2f63f26edc99f62fa4566654f8b46