0b76e0e7ed26277903223f3b0868cf303f8a6b5c05c045eb94a6d6ca3e9a4f89

General

Target

no_dropper.apk
Size

3.5MB
MD5

15f59da4589a0b9fc3b9d4c0f261fe50
SHA1

a819d8132a20e6f6b375d4c2c813776d7692ea48
SHA256

0b76e0e7ed26277903223f3b0868cf303f8a6b5c05c045eb94a6d6ca3e9a4f89
SHA512

b843e5153d38e210be5fe4cbd54d7d28b260cb4f655790090731f479b2a74c0c1bb80d32963b3c867730b40c6eeda9900cdc8649ff7091dd6e104ba7c97367a4
SSDEEP

49152:2gWAVs7LxUOmZt3svb3Y5tWWqbFg+BgKDhEVe14mMcCnJMzvvD9jz0o/Vz:l67Lxm+b38tWtbF9pBaPcrLxjQa

Score

7^/10

collection credential_access discovery evasion persistence

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 6 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.example.mysoul

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4999

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5490

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:5543

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

Input Injection

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
bd35547fbda298a099f4d729e021a19e

SHA1
75e5528df9d35bc2928bcdae4b1e53df8e8fdc48

SHA256
1b9b0cd80e2853e2fd4d1638baa168be0725a7b3edcaf0f517d77d51b83edd61

SHA512
6ab875fee0578e228aacfd7f0a5d8d95ff2004afc42b7ad1ffd0c1ae4383fa76fdc5bd94dead822989783a4dca2145f30f8f8542ce4ca51f8a00f58b948f410c

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
32KB

MD5
94052b23a753626e3a9e0365a9aae3c9

SHA1
20874dcf989edcd773260bc0e135075d3d751314

SHA256
e55bd3996ce517219c618cc8914fb5002f19a3b54cb2add030dde55b8ef09bd2

SHA512
c8e81e575cb96d1b614555799e887fe2572c3d47b907b95edb45b15d65aa1f2424fd69046035cd0e434a2ab21b44a8ab9e0a0db333ae509943b255345ffffa93

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
451580930c1771b865d871101986f0ad

SHA1
699a1fbaa6acbc2464a55e745e2d94d76d7e387a

SHA256
f7dec3dcfbb151ec609c0701c3f61546ea742053aed62ab1b04b545e7a4b8743

SHA512
6df4b86af562f571e3b315e1b0362a12796165e2e02d66c67dcbed48f2b52af6cfb569f56cb4a299272bcca88013b40b26181610efd658ede2fab768df506ea7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads