Analysis
-
max time kernel
135s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
16-11-2024 22:40
Behavioral task
behavioral1
Sample
no_dropper.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral2
Sample
no_dropper.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral3
Sample
no_dropper.apk
Resource
android-x86-arm-20240910-en
General
-
Target
no_dropper.apk
-
Size
3.5MB
-
MD5
15f59da4589a0b9fc3b9d4c0f261fe50
-
SHA1
a819d8132a20e6f6b375d4c2c813776d7692ea48
-
SHA256
0b76e0e7ed26277903223f3b0868cf303f8a6b5c05c045eb94a6d6ca3e9a4f89
-
SHA512
b843e5153d38e210be5fe4cbd54d7d28b260cb4f655790090731f479b2a74c0c1bb80d32963b3c867730b40c6eeda9900cdc8649ff7091dd6e104ba7c97367a4
-
SSDEEP
49152:2gWAVs7LxUOmZt3svb3Y5tWWqbFg+BgKDhEVe14mMcCnJMzvvD9jz0o/Vz:l67Lxm+b38tWtbF9pBaPcrLxjQa
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 10 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
com.example.mysoulcom.example.mysoulcom.example.mysoulcom.example.mysoulcom.example.mysoulioc Process /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.example.mysoulcom.example.mysoulcom.example.mysouldescription ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.example.mysoul Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.example.mysoul Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.example.mysoul -
Queries information about running processes on the device 1 TTPs 5 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.example.mysoulcom.example.mysoulcom.example.mysoulcom.example.mysoulcom.example.mysouldescription ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul -
Acquires the wake lock 3 IoCs
Processes:
com.example.mysoulcom.example.mysoulcom.example.mysouldescription ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.example.mysoul Framework service call android.os.IPowerManager.acquireWakeLock com.example.mysoul Framework service call android.os.IPowerManager.acquireWakeLock com.example.mysoul -
Makes use of the framework's foreground persistence service 1 TTPs 3 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.example.mysoulcom.example.mysoulcom.example.mysouldescription ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.example.mysoul Framework service call android.app.IActivityManager.setServiceForeground com.example.mysoul Framework service call android.app.IActivityManager.setServiceForeground com.example.mysoul -
Checks CPU information 2 TTPs 4 IoCs
Processes:
/system/bin/cat /proc/cpuinfo/system/bin/cat /proc/cpuinfo/system/bin/cat /proc/cpuinfo/system/bin/cat /proc/cpuinfodescription ioc Process File opened for read /proc/cpuinfo /system/bin/cat /proc/cpuinfo File opened for read /proc/cpuinfo /system/bin/cat /proc/cpuinfo File opened for read /proc/cpuinfo /system/bin/cat /proc/cpuinfo File opened for read /proc/cpuinfo /system/bin/cat /proc/cpuinfo
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4214
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:4488 -
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
PID:4517
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4543 -
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
PID:4578
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4606 -
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
PID:4637
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:4676 -
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
PID:4709
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD594a6842d0e7fa46496f5052395031a32
SHA1e14df775b4d04e229e2410711824ca9b71606e0c
SHA25615402371fad0a624b57ea94f30c53bc29a007a447966ee8cb5861de80d347017
SHA51296954d1a2a1c5c48ec822b14fb9d1ad32a19bcff95e71b7c396e5665b240accc688cc5bb1546e2fe17a4facac106e61cf1491dc52c0efea5af4c6ab1e45e5d3f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5aadbfe2ca5e87f1ff1bc7c1e4ebb94ad
SHA10c1bcdb2b7a841dd9ba857b400c209e26de3aa56
SHA2563fcb67b098aeb156bd97b52830bb96e625e937c7068ab7503fda18dc48ff226b
SHA512727f19d56c78de6b4826b2ce364d68d0f13aa4fff7203719ec9726a935413c264b400abd6714948c8111e748bf87a15dcb34c461fb9c2d8236d83644ea5a64fe
-
Filesize
108KB
MD55bbe8a67400b41cb1aa6af9b066e0387
SHA1cf3d88aeb0591a83036744b8b7a71f04e02329e4
SHA256a582f5d6a027c0aefa3248bf260f0e98cd46a735461dc428d4a320620e8875f3
SHA512af8af092df5bff7d7e8d2247956e24e5f12f601cfb806e590b059768a20e9ca002241e00bb10c32549eb37ef8d6d3aa51865b5174a2576c24f5a9e0ec92243e4