Analysis
-
max time kernel
101s -
max time network
151s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
12-11-2024 22:07
General
-
Target
e9515238f096e249a73b7cce538cc54dd890f71dfb972e9b830fafa4b52051a9.apk
-
Size
3.4MB
-
MD5
36794af87e599f3598490a24fb772b91
-
SHA1
8eb5e5e5092b5abb8d1f3c04c3baf5ab0321a890
-
SHA256
e9515238f096e249a73b7cce538cc54dd890f71dfb972e9b830fafa4b52051a9
-
SHA512
a2fc5e2cf2990f1d416129b356c37db7dc60e07ce5c74c2d54dd17b9fd66d34bcca8d7ad86c11082501c54b1702cd980106b7ce112c83c0348333a669424ef8e
-
SSDEEP
98304:PPPWl9BImOCp+CoR9b+0sGC9Pc89Sk5rY03Ldraaj:HPWl9BnO0+59iFx9Pf9Sk577deaj
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 12 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service 4 TTPs 5 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 6 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 4 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 4 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 5 IoCs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c90fa26af4f090639ee066836a50ca49
SHA12f450c899eda32e4f17d8fb318d26becfbc75a0e
SHA25632b00e876d1a75663f1e3d6b1bd53f496a8459e038b63ce209e9e0e3a916e997
SHA5128ad839176abe2c3d08e80b9f966e37180445084d097bce03ecb6eb7c8e8092cd207542a816d48228680f0d6b846713adc949cdb975853a8d830472a35465fc8a
-
Filesize
108KB
MD59fffbb02a9717b15e514a253faa6b72c
SHA1396b39ca655762d761452e0b4e35f33a041e5bc7
SHA256acc5bef9771afb8ca50d65f42977ba7c6664c75c2835dc3092a47baf0a4b46fc
SHA512313bd921e1303c578fd86a7b4512272da52fbd9870442a5da4307ff35d633819ef253fa814b18e124a33716d881eb57275c3b51930acaa84eef209eb23a2f928
-
Filesize
28KB
MD510c52c6d23727d9ee42f1dc782dd8bc5
SHA14fad71518aee6ca6c2a96de12f3930d6f43bf87d
SHA256fbbcc3978597bdf0b7626c21881bd2f7a280954c33e87315dfff2dc6b919ba0c
SHA5125560a85fc9b268e125c225602b24e66a9e7395807e88b7aedba1813ad3db508ad0f59f454937af4405af937b783b4f15e53523cbf21ca44455279bf5953f39da