Analysis
-
max time kernel
149s -
max time network
149s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
05-11-2024 15:55
Static task
static1
Behavioral task
behavioral1
Sample
159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4.apk
-
Size
4.2MB
-
MD5
68139c9e7960d3eb956472bdc5ed5ad2
-
SHA1
dba76029847dce4aa71d0e48bdf7cfe7e0174f35
-
SHA256
159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4
-
SHA512
3efa922963f3d754eace54187875aa41be3a5fa353c4e217c6c3424aedb5fd7e00932ccd163288e7c34b906ffdfaf849f79f5b2bac0557301361f696cdfe541e
-
SSDEEP
98304:s1H2sNAKHdW7C31CrRpPc1qYSUITkBElGfZnGp972k0OOnbG8h:s1Q7C+pmqJr0zfZGpYrA6
Malware Config
Extracted
tgtoxic
https://ctrl.dksu.top
-
uri
/adv.php?apk=
Extracted
tgtoxic
https://d.dblpap3.top/loading2.html
Signatures
-
TgToxic
TgToxic is an Android banking trojan first seen in July 2022.
-
TgToxic payload 2 IoCs
resource yara_rule behavioral1/memory/4281-0.dex family_tgtoxic behavioral1/memory/4224-0.dex family_tgtoxic -
TgToxic_v2 payload 2 IoCs
resource yara_rule behavioral1/memory/4281-0.dex family_tgtoxic_v2 behavioral1/memory/4224-0.dex family_tgtoxic_v2 -
Tgtoxic family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.example.mysoul/app_grief/wH.json 4281 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.mysoul/app_grief/wH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.example.mysoul/app_grief/oat/x86/wH.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.example.mysoul/app_grief/wH.json 4224 com.example.mysoul -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.example.mysoul Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.example.mysoul Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.example.mysoul -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.example.mysoul -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.example.mysoul -
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.example.mysoul android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.example.mysoul -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.example.mysoul -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.example.mysoul -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.example.mysoul -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.example.mysoul -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.example.mysoul -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.example.mysoul -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.example.mysoul -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.example.mysoul
Processes
-
com.example.mysoul1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4224 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.mysoul/app_grief/wH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.example.mysoul/app_grief/oat/x86/wH.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4281
-
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
2System Network Configuration Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5cda4ec8948b2584cb84b70db63e8124b
SHA167103cf617a10dd32ffabd036ac92cce434f1add
SHA2569ae46f49937c95780156f36b4577ec05bac59a8f5e51dcb245885c68257302e2
SHA512b46e2df21bff89c315e6e64c8df795c808eebc2978ea38f6aa4bc396c332ea531593a792bd127f8633687d9d049cfa9b664f02b15578b9e41a56ad3057b0d4d8
-
Filesize
1.5MB
MD5a941cf153c00a6df4392d3d4bdfda7b1
SHA1b568b8ba0fad3590bf9c9d680a96a9e05545d940
SHA25664eea7cf82606726872f116e49f89af8a1ccafcff747f78dedef46d5618f4a02
SHA512e2d4136d51c19c9fa4d74aa835bd9a9d0efd0ac41bd26be439150f7fe788828b41d88e5708aa0a5ad449e8b294e9e7e527de66f0474d37f80fc3d8d0be5df0e1
-
Filesize
940B
MD5fd42b38a64ffb153df0fc0d1cedf780f
SHA121ab32c80465f7f1a760bedf4782a6292220f31a
SHA256b5d7217edaf72ae337e805c1cf70cf5d4697e2c62a1c7d2ec51e78b5399927ba
SHA512916026ce46e5b40bc5bf9b6705c4160d87a432e533ee8490d8f2013c114d85eab3bfa4f0f621c2e658c20fe377cd12f470ee0162ee64831322c237de6d1bd7f9
-
Filesize
3.4MB
MD53dc26a3d07ba6f056b74c08e771ba8af
SHA1813c6e2464d8fdc702dcaa3b3804c3c26280407c
SHA256d27f314f8d790a0fbc4b91545616e0c18c6bfaa0704eb17eacf43ff8ea0e481b
SHA512c1037f8794567634f8ec28466176bf87c3f35b641869bd08275d246953c9d7f63b06a161aa2462b24e0e915a8346d363854f33c73a6910f2ca9aec9315d96b25
-
Filesize
3.4MB
MD51ef35068c2219a60eaf997eb30fc80a3
SHA14b93bb6b12d1fcf8aff67df3269e280438ce0588
SHA25642a8314562b8e32ad4aff7a65d6eedec79b599d767f731cc4947678f8cffaad2
SHA5129ff5ff4fd5489ad5862428a39f92bfd27e8b852a70c45ff06d506fabd95b081420bcf60ba158ad44d439d2f7e78e6e1ccad2f63f26edc99f62fa4566654f8b46