Overview

overview

10

Static

static

6

159a7af39c...c4.apk

android-9-x86

10

159a7af39c...c4.apk

android-10-x64

10

159a7af39c...c4.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    05-11-2024 15:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4.apk

  • Size

    4.2MB

  • MD5

    68139c9e7960d3eb956472bdc5ed5ad2

  • SHA1

    dba76029847dce4aa71d0e48bdf7cfe7e0174f35

  • SHA256

    159a7af39c0d6c2334df77088fe2d545a96d591dbf2b85c373a4a45377f492c4

  • SHA512

    3efa922963f3d754eace54187875aa41be3a5fa353c4e217c6c3424aedb5fd7e00932ccd163288e7c34b906ffdfaf849f79f5b2bac0557301361f696cdfe541e

  • SSDEEP

    98304:s1H2sNAKHdW7C31CrRpPc1qYSUITkBElGfZnGp972k0OOnbG8h:s1Q7C+pmqJr0zfZGpYrA6

Score
10/10
tgtoxicbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan

Malware Config

Extracted

Family

tgtoxic

C2

https://ctrl.dksu.top

Attributes
  • uri

    /adv.php?apk=

Extracted

Family

tgtoxic

C2

https://d.dblpap3.top/loading2.html

AES_key

Signatures

  • TgToxic

    TgToxic is an Android banking trojan first seen in July 2022.

    infostealertrojanbankertgtoxic
  • TgToxic payload 2 IoCs
  • TgToxic_v2 payload 2 IoCs
  • Tgtoxic family
    tgtoxic
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.example.mysoul
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4224
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.mysoul/app_grief/wH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.example.mysoul/app_grief/oat/x86/wH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4281

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Foreground Persistence

1
T1541

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Foreground Persistence

1
T1541

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Process Discovery

1
T1424

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.example.mysoul/app_grief/wH.json
    Filesize

    1.5MB

    MD5

    cda4ec8948b2584cb84b70db63e8124b

    SHA1

    67103cf617a10dd32ffabd036ac92cce434f1add

    SHA256

    9ae46f49937c95780156f36b4577ec05bac59a8f5e51dcb245885c68257302e2

    SHA512

    b46e2df21bff89c315e6e64c8df795c808eebc2978ea38f6aa4bc396c332ea531593a792bd127f8633687d9d049cfa9b664f02b15578b9e41a56ad3057b0d4d8

    Download Submit

  • /data/data/com.example.mysoul/app_grief/wH.json
    Filesize

    1.5MB

    MD5

    a941cf153c00a6df4392d3d4bdfda7b1

    SHA1

    b568b8ba0fad3590bf9c9d680a96a9e05545d940

    SHA256

    64eea7cf82606726872f116e49f89af8a1ccafcff747f78dedef46d5618f4a02

    SHA512

    e2d4136d51c19c9fa4d74aa835bd9a9d0efd0ac41bd26be439150f7fe788828b41d88e5708aa0a5ad449e8b294e9e7e527de66f0474d37f80fc3d8d0be5df0e1

    Download Submit

  • /data/data/com.example.mysoul/cache/sb113517096516421422097.mp3
    Filesize

    940B

    MD5

    fd42b38a64ffb153df0fc0d1cedf780f

    SHA1

    21ab32c80465f7f1a760bedf4782a6292220f31a

    SHA256

    b5d7217edaf72ae337e805c1cf70cf5d4697e2c62a1c7d2ec51e78b5399927ba

    SHA512

    916026ce46e5b40bc5bf9b6705c4160d87a432e533ee8490d8f2013c114d85eab3bfa4f0f621c2e658c20fe377cd12f470ee0162ee64831322c237de6d1bd7f9

    Download Submit

  • /data/user/0/com.example.mysoul/app_grief/wH.json
    Filesize

    3.4MB

    MD5

    3dc26a3d07ba6f056b74c08e771ba8af

    SHA1

    813c6e2464d8fdc702dcaa3b3804c3c26280407c

    SHA256

    d27f314f8d790a0fbc4b91545616e0c18c6bfaa0704eb17eacf43ff8ea0e481b

    SHA512

    c1037f8794567634f8ec28466176bf87c3f35b641869bd08275d246953c9d7f63b06a161aa2462b24e0e915a8346d363854f33c73a6910f2ca9aec9315d96b25

    Download Submit

  • /data/user/0/com.example.mysoul/app_grief/wH.json
    Filesize

    3.4MB

    MD5

    1ef35068c2219a60eaf997eb30fc80a3

    SHA1

    4b93bb6b12d1fcf8aff67df3269e280438ce0588

    SHA256

    42a8314562b8e32ad4aff7a65d6eedec79b599d767f731cc4947678f8cffaad2

    SHA512

    9ff5ff4fd5489ad5862428a39f92bfd27e8b852a70c45ff06d506fabd95b081420bcf60ba158ad44d439d2f7e78e6e1ccad2f63f26edc99f62fa4566654f8b46

    Download Submit