dropper.apk
- SHA256 e2840f0ccb7f2d1f719eb2bef275efe19b1b76af86f8f504804c6b42aa1b678d
com.mem.installdropsession
Behavioral task
behavioral1
Sample
dropper.apk
Resource
android-x64-arm64-20240624-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
dropper.apk
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
base.apk
Resource
android-x64-arm64-20240624-en
android-11-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
base.apk
Resource
android-33-x64-arm64-20240624-en
android-13-x64
9 signatures
150 seconds
General
- Target dropper.apk
- Size 5.4MB
- Sample241116-2bsa2ayqhm
- SHA256 e2840f0ccb7f2d1f719eb2bef275efe19b1b76af86f8f504804c6b42aa1b678d
- MD5 9e7d671e6d45dc805d846c1bf3ab60aa
- SHA1 a2aa5f3258b4ed4c0e9189dca411bf2ded23e426
- SHA512 d679eb8711ceb69615f277b30e8d85766a0840746fe4b9b42dc587686f367de54cd4ab3257df0309807531b5b5721b8108dd7da7918274f7b97f2d1dadd87dda
- SSDEEP 98304:EXVSsuxGCamIBlOMdY23SHQtuXKUIIa9OiEbBrb1zyVZPlOxS:EXKlamcHkQA6N9EbRqn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- TgToxic payload 1 IoCs
resource yara_rule static1/unpack001/base.apk family_tgtoxic - TgToxic_v2 payload 1 IoCs
resource yara_rule static1/unpack001/base.apk family_tgtoxic_v2 - Tgtoxic family
- Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 2 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE - Requests dangerous framework permissions 1 IoCs
description ioc Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES
File Explorer
-
dropper.apk.apk 5.4MB
-
base.apk.apk 3.5MB
base.apk
- SHA256 6dd3b5e01f18ef927d2a15dd0adef150be7eca8860f727e63faf7a292418a760
- MD5 20cec677a95b399dcf803a27ef676665
- SHA1 581dd0f7826caddd2da2fb60d5a0016735a6c254
- SHA512 706f7f8a92591b31b9f1273e784a1609bc8e38fb1da503d17757eafc7df9df3e63585c687d7960d9c9acc7b8b0ee9fbbc1eec6b354059d8273fa058e164e0b48
- SSDEEP 49152:+gW6Vs7LxUOmZtTsvb3Y5tWWqbFg+BgKDhEVe14mMcCnJMzvvD9jz0o/Gn:n67Lxmub38tWtbF9pBaPcrLxjQz
- MD5 SHA1 SHA512 SSDEEP
-
TgToxic payload
-
TgToxic_v2 payload
com.example.mysoul
com.example.mysoul.YkhhzkkMkmvrzne
android.permission.READ_SMS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.CAMERA
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WAKE_LOCK
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.GET_PACKAGE_SIZE
android.permission.CALL_PHONE
android.permission.READ_PHONE_STATE
android.permission.READ_CONTACTS
android.permission.USES_POLICY_FORCE_LOCK
android.permission.BATTERY_STATS
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.REORDER_TASKS
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND
android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.QUERY_ALL_PACKAGES
android.permission.GET_INSTALLED_APPS
android.permission.POST_NOTIFICATIONS
android.permission.TURN_SCREEN_ON
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_AUDIO
android.permission.BLUETOOTH_CONNECT
com.vivo.permission.manage.permission.ACCESS
oppo.permission.OPPO_COMPONENT_SAFE
com.huawei.permission.external_app_settings.USE_COMPONENT
com.android.alarm.permission.SET_ALARM
android.permission.WRITE_SETTINGS
android.permission.CLEAR_APP_CACHE
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.VIBRATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.EXPAND_STATUS_BAR
android.permission.SCHEDULE_EXACT_ALARM
android.permission.USE_EXACT_ALARM
android.permission.RECEIVE_USER_PRESENT
com.android.launcher.permission.READ_SETTINGS
com.android.launcher.permission.WRITE_SETTINGS
com.android.launcher2.permission.READ_SETTINGS
com.android.launcher2.permission.WRITE_SETTINGS
com.android.launcher3.permission.READ_SETTINGS
com.android.launcher3.permission.WRITE_SETTINGS
com.example.mysoul.YkhhzkkMkmvrzne
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.SEND
android.intent.action.SENDTO
np.࣑
np.࣒
np.ࣂ
xyz
np.ࣸ
com.example.mysoul.MxomjubefPlwf
np.ࣩ
np.ࣗ
np.ࣇ
np.ࣙ
pub.devrel.easypermissions.৭
com.example.mysoul.QtifsubdIpnu
MAIN.STARTED.ACTION
np.࣓
com.example.mysoul.BOOT_JOB
android.intent.action.BOOT_COMPLETED
np.࣮
np.ࣁ
np.ࣄ
np.ࣷ
np.ࣱ
np.ࣹ
np.ࣔ
np.࣫
android.accessibilityservice.AccessibilityService
np.ࣰ
android.service.notification.NotificationListenerService
com.example.mysoul.GekdrxcFsqkfybgxf
np.࣐
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
androidx.room.MultiInstanceInvalidationService
np.ࣨ
RestartSensor
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.USER_PRESENT
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.LOCKED_BOOT_COMPLETED
android.intent.action.QUICK_INFO
android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.SMS_DELIVER
BOOT_COMPLETED1
android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED
android.hardware.usb.action.USB_STATE
android.intent.action.WALLPAPER_CHANGED
android.provider.Telephony.SMS_RECEIVED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.BATTERY_CHANGED
np.ࣘ
android.app.action.DEVICE_ADMIN_ENABLED
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
android.net.conn.CONNECTIVITY_CHANGE
androidx.work.impl.background.systemalarm.RescheduleReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.UpdateProxies
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.diagnostics.REQUEST_DIAGNOSTICS
androidx.startup.InitializationProvider
Android Permissions
dropper.apk
Permissions
android.permission.REQUEST_INSTALL_PACKAGES