General

  • Target

    no_dropper.apk

  • Size

    3.5MB

  • Sample

    241116-2lw2zavlaw

  • MD5

    15f59da4589a0b9fc3b9d4c0f261fe50

  • SHA1

    a819d8132a20e6f6b375d4c2c813776d7692ea48

  • SHA256

    0b76e0e7ed26277903223f3b0868cf303f8a6b5c05c045eb94a6d6ca3e9a4f89

  • SHA512

    b843e5153d38e210be5fe4cbd54d7d28b260cb4f655790090731f479b2a74c0c1bb80d32963b3c867730b40c6eeda9900cdc8649ff7091dd6e104ba7c97367a4

  • SSDEEP

    49152:2gWAVs7LxUOmZt3svb3Y5tWWqbFg+BgKDhEVe14mMcCnJMzvvD9jz0o/Vz:l67Lxm+b38tWtbF9pBaPcrLxjQa

Malware Config

Targets

    • Target

      no_dropper.apk

    • Size

      3.5MB

    • MD5

      15f59da4589a0b9fc3b9d4c0f261fe50

    • SHA1

      a819d8132a20e6f6b375d4c2c813776d7692ea48

    • SHA256

      0b76e0e7ed26277903223f3b0868cf303f8a6b5c05c045eb94a6d6ca3e9a4f89

    • SHA512

      b843e5153d38e210be5fe4cbd54d7d28b260cb4f655790090731f479b2a74c0c1bb80d32963b3c867730b40c6eeda9900cdc8649ff7091dd6e104ba7c97367a4

    • SSDEEP

      49152:2gWAVs7LxUOmZt3svb3Y5tWWqbFg+BgKDhEVe14mMcCnJMzvvD9jz0o/Vz:l67Lxm+b38tWtbF9pBaPcrLxjQa

    • TgToxic

      TgToxic is an Android banking trojan first seen in July 2022.

    • Tgtoxic family

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks