Overview

overview

10

Static

static

10

no_dropper.apk

android-9-x86

7

Analysis

  • max time kernel
    71s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    11-12-2024 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    no_dropper.apk

  • Size

    3.6MB

  • MD5

    89c4c3287a0f19fdd722b0c13e68b0ce

  • SHA1

    3bc5858cec98a101bc63a4401d21a1d0b8922076

  • SHA256

    12d94320a25c1496ae3c7d326e07d4d92d34381d7b821f58ef9f4e135612c6d8

  • SHA512

    13944a4cc38396ab5670eac3e63e8e9642507bdc81a7cb644880bed30563163fc9d72e81f687096da87b72dbc04365e16d2f5d0d0510ba979e785a3623473b3c

  • SSDEEP

    98304:Yg1y8VpuJVX9wmPqE2kmggcjIV6IldYpJJtYkCufNSAkLCjzLi:Hy8VpuJVrqE2k9gcjI1EJSkCuVSBC/+

Score
7/10
collectioncredential_accessdiscoveryevasionpersistence

Malware Config

Signatures

  • Checks known Qemu pipes. 1 TTPs 12 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries information about running processes on the device 1 TTPs 6 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 2 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Checks CPU information 2 TTPs 5 IoCs

Processes

  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    PID:4266
    • /system/bin/cat /proc/cpuinfo
      2⤵
      • Checks CPU information
      PID:4294
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    PID:4337
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    PID:4424
    • /system/bin/cat /proc/cpuinfo
      2⤵
      • Checks CPU information
      PID:4462
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    PID:4557
    • /system/bin/cat /proc/cpuinfo
      2⤵
      • Checks CPU information
      PID:4586
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Makes use of the framework's Accessibility service
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    PID:4611
    • /system/bin/cat /proc/cpuinfo
      2⤵
      • Checks CPU information
      PID:4649
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4676
    • /system/bin/cat /proc/cpuinfo
      2⤵
      • Checks CPU information
      PID:4706

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal
    Filesize

    512B

    MD5

    2cfc980835b6fb38089259240e0c2f46

    SHA1

    02d205745590fa8a644f4dbee258c44d9773dbcb

    SHA256

    2f4e62dc566fee5de3779e98aed369aa4ca87596d328f79d5c50d8a3729c8b17

    SHA512

    8eba744fbb190a09ec226f4018f51e7b3d3c95dbdc179361a9208ecf555a13e856dd448c95cafc776b382cf84eb9249ad454fbc1d70c3d02d37a779ed1eaec66

    Download Submit

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm
    Filesize

    108KB

    MD5

    089f075264c428b397c4a71e8dcfdd57

    SHA1

    6277728a4bf9b69aacc2c286542f9bf3ca9e2e1f

    SHA256

    9e4e4ef88e22fa5b994dd17fa8c1918a8d03dc1af38403accf9e0825264ffbf2

    SHA512

    046d3197b55ae5bb1dd33fab391c04b0f7c421efc381e4e4c687151a3e1d07882fd514dec5fb11df8f069dbbf08abb16c0ec075fc2a51864ef3e67b2d69f5345

    Download Submit

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
    Filesize

    28KB

    MD5

    5b0e8a6b8250f7fe2bcab5e8757a667a

    SHA1

    5c9fa6ca2fc3950de1cab6eb4d727c73b3aa1511

    SHA256

    fbfebb7d4dd306533c560938212365d2b572e22937fd18f695ef4f9a8c44f795

    SHA512

    db8b5c7605280e0b51d80c2d7a8c5d424a530b45284aedb3b3dd8b96566ea3a8575357da360934aac6bd0dba920a79d548d0b61e65cb22cf9acc90c07c110218

    Download Submit