Analysis
-
max time kernel
23s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
01-12-2024 21:22
General
-
Target
tg.apk
-
Size
3.4MB
-
MD5
00ea37c8d4d22cc8e0d5438121368140
-
SHA1
f36242b33a26bdc3b0f9e43581e9d52bfc76c353
-
SHA256
3b8ff929d8a1b47164901c932af1b77f56f0ddeb83db3064fd6fd49a2bf50c59
-
SHA512
bf894f36848699afbbbdb1d2245b1523112c7cfcc380714d2ee52fed9e392f8a682a3f05900db56a1acddf4ec9185421eb7b2041fe1ee901339a7a177f467149
-
SSDEEP
98304:A67LxA+PscPoX0eItCneBvAj3NeDP1QhA5PrLYjQV:/7LxA+CFItCneBIjd8dQhaPXY0V
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 8 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 3 IoCs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD561e8a2a0b7ad324bb7ee91789bac12f2
SHA190e6439cf107874ab783e6fb064b9fac8bf790ac
SHA25667307e3e115de7548984198e31778eeb92388e2abc65b0d0d67a23f8634fd4f6
SHA512d7fa8ecb1c9735305d52e2fd6f65c9728ab828acce83eb2ae1290d567140b94a984edfef65aa772cdd9f0180bd61c5a721274e93e68a4187f058b5cef1695fc9
-
Filesize
108KB
MD5f4cbc01180509ffc547a23f715c17984
SHA192c0c118a1df56c94953fb884fddf510a9f0fb89
SHA25632b8d4919ff96355dbd6be0b68397a3c679a27f30b1d97f9a97a471326ae68ee
SHA512c5d981edc946552cbe9083009ddc5c54c41cc4b305bacfed31a04af9ea5704243a226d74b5fe2299611f82ae8cee06046c60debbb63581f8306322c199262d83
-
Filesize
28KB
MD5c30e8fe94a2bb1e397cb620d0279dda0
SHA1b81873501807eed1b6e7510d92b41d7d3fc0b853
SHA2563fefd5bdab69f247297e7729c0e3310e5f088ce8d77a8bee3a9334ab7e991135
SHA5129bfbba49f47c3da4e6f325fdacc1803f9179c607db976ec392e90ee3bc51d198e6171e3e0f229ca7ef6fd0af8bf170e50fe982664cc3a6adc52a67a23caf4f4b