Analysis
-
max time kernel
23s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
12-12-2024 02:55
General
-
Target
base.apk
-
Size
3.6MB
-
MD5
133e25a18b8500d6abd78fbcc60bc044
-
SHA1
f1638daab573cbc191e97fefb04daf030fbfb311
-
SHA256
86fdfff09f03b0cde4cd0cde3ce0f75e37859925ef6fd89b372bbfada1ace572
-
SHA512
86fcb70d305ed5a0339bbba113b476e47447f5927f2903adfa109dcdb1cafeb2e79dbef1564088a982e5e4031e091a6416500f94d1980176887320b8c6cb1929
-
SSDEEP
49152:abgWswiy8VQ7mZt8zvnPxv+rbvleFmLzz6f37LKrYEkw2w/RnJorzvvR9j00oln4:aq1y8VQuGpGJeFmXtYDw2kErLPjz1
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 10 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 5 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 2 IoCs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5261dadb00029af5f69504d4d8d61463f
SHA130787cbe35b5196509872b2928a7c34822e3b311
SHA256e86c24fe04e65ba63f85db067d6bf0ba817760705604d98ca5c723d07bb88739
SHA51245b1097c160939b8f1b435f1aad3486fb5293bed5492ab02392da1861523aba9a16f6bf39d18c2687468433ed2e90068c6f49af720adeec0b44c963666614fd6
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
28KB
MD59f1c47921d37bd54533d6b5f2b875675
SHA1bfaf4aeeba9b7f1b0dd857c7d3b58943b99a2584
SHA256ab47d62a63263eb79ff63bfa037e5b3be3d903c4cf15d03737982fd1c0d21afb
SHA512b22c3ef7d91d9a0cffd946aa1a20e2ee6a68b2764d760c3e9cf9502b52500fb4d595919c682559e7c5f09972d18f357a2b774e2da22edd1075b703d35b31a3ec
-
Filesize
108KB
MD5708ac8c81e4a53fc4fb2a1e2988fbc56
SHA1edc4130e99d10ebd4cf714369fea12ddec86baaf
SHA256f76e7d5d8ef88a23821135518e0a26c811445c7909ab5e6c21c11467d87f48e2
SHA512308070f97dcf5fc7c90a4ce82e491c2413b0a5470175038c79b7c932f6000ab707f6c3d7961a2173deafc603673e286190bc5d76f52a0dc7aa10724a903dbc6f