f984ad6b075426be8dda2f28e1212d5c070fb92318d6590ab4436427aa556730

Analysis

max time kernel
32s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
11-12-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

3.6MB
MD5

133e25a18b8500d6abd78fbcc60bc044
SHA1

f1638daab573cbc191e97fefb04daf030fbfb311
SHA256

86fdfff09f03b0cde4cd0cde3ce0f75e37859925ef6fd89b372bbfada1ace572
SHA512

86fcb70d305ed5a0339bbba113b476e47447f5927f2903adfa109dcdb1cafeb2e79dbef1564088a982e5e4031e091a6416500f94d1980176887320b8c6cb1929
SSDEEP

49152:abgWswiy8VQ7mZt8zvnPxv+rbvleFmLzz6f37LKrYEkw2w/RnJorzvvR9j00oln4:aq1y8VQuGpGJeFmXtYDw2kErLPjz1

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
920417bb5777be39114f2a6f50373e3a

SHA1
89acf17ecd6be28c1e17f0ca79c8dbb72675db47

SHA256
75b8a2b8e5c977431c5288d6fd841973173eeacdb5579c78983fb2de0e6cadbf

SHA512
a235f821529f30a2931badc526dc94ef8abf6001b35a16dc42d005bf4f5bd283ce52e007c6c32ae2d3cdd1d6f6986af3a588b5118b7da2dc88e4a4a8b0c3ff69

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
809942c5aca29383ab5ff5fefa09b84a

SHA1
dfcac19f66328bffbed0d45bd446f01c3c624d33

SHA256
2356ebc8f12e7e6acf1e068964c0e01354ec96d6095779b61fbd22123f57b06b

SHA512
f2c1e77cdc282cb4dbac34bd2d16d929726267331ab44d32e7df637f945f2b45c3902f818dc95e3ee2420c169b80916bba802e5819b6e6507b4172aa029dc403

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
5bbeb51eb111a8130b09ad5a2402b05d

SHA1
547935648939dc461fb703b51ece5142292f5b08

SHA256
56c9c0661c8592f54794f76cabffa8230127a9d0b483f1679483a8a7fe81681e

SHA512
e3916b329dbe60508718b21b683354779417a230f7620d2a2c62865c25d1b2b68fced04260fc3df2927c06c696aeb118a709bc4d800b60604cbb4b0cb145a99c

Download Submit