tgtoxic | 14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28[.]bin

General

Target
14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin
Size 3.7MB
Sample241225-3a8gas1lev
SHA256 14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28
MD5 d92c0d97c8beabde5d41777e98f8e9f6
SHA1 6e074e132de20cea49cdabbfbb6c1048ed3d1e04
SHA512 046b031cc5c6e2226f1acc2f1a02bdf514f65be43bd7cd05ea26f81eb4aed1aee17e30664d1036f0bf93e6d70c6457200061d7ee3b13c893fef19463a1a99c27
SSDEEP 98304:KI1y8VlJ8mgRNdWSJCyZx4dBXa2QFjL6/CSZdf+x8F678YLNcjXr:By8V38miWVXdNAmaSZ0uM8GNcDr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tgtoxic

Malware Config

Signatures

TgToxic payload 1 IoCs

resource	yara_rule
sample	family_tgtoxic

TgToxic_v2 payload 1 IoCs

resource	yara_rule
sample	family_tgtoxic_v2

Tgtoxic family
tgtoxic
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 20 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

File Explorer

14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin

.apk 3.7MB

14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin

SHA256 14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28
MD5 d92c0d97c8beabde5d41777e98f8e9f6
SHA1 6e074e132de20cea49cdabbfbb6c1048ed3d1e04
SHA512 046b031cc5c6e2226f1acc2f1a02bdf514f65be43bd7cd05ea26f81eb4aed1aee17e30664d1036f0bf93e6d70c6457200061d7ee3b13c893fef19463a1a99c27
SSDEEP 98304:KI1y8VlJ8mgRNdWSJCyZx4dBXa2QFjL6/CSZdf+x8F678YLNcjXr:By8V38miWVXdNAmaSZ0uM8GNcDr
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:arm64

TgToxic payload
TgToxic_v2 payload

com.example.mysoul

android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.CAMERA android.permission.SYSTEM_ALERT_WINDOW android.permission.WAKE_LOCK android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.GET_PACKAGE_SIZE android.permission.CALL_PHONE android.permission.READ_PHONE_STATE android.permission.READ_CONTACTS android.permission.USES_POLICY_FORCE_LOCK android.permission.BATTERY_STATS android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.REORDER_TASKS android.permission.FOREGROUND_SERVICE android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND android.permission.REQUEST_INSTALL_PACKAGES android.permission.REQUEST_DELETE_PACKAGES android.permission.QUERY_ALL_PACKAGES android.permission.GET_INSTALLED_APPS android.permission.POST_NOTIFICATIONS android.permission.TURN_SCREEN_ON android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.READ_MEDIA_AUDIO android.permission.BLUETOOTH_CONNECT com.vivo.permission.manage.permission.ACCESS oppo.permission.OPPO_COMPONENT_SAFE com.huawei.permission.external_app_settings.USE_COMPONENT com.android.alarm.permission.SET_ALARM android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.CLEAR_APP_CACHE android.permission.ACCESS_NOTIFICATION_POLICY android.permission.VIBRATE android.permission.MODIFY_AUDIO_SETTINGS android.permission.EXPAND_STATUS_BAR android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.RECEIVE_USER_PRESENT com.android.launcher.permission.READ_SETTINGS com.android.launcher.permission.WRITE_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher2.permission.WRITE_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.android.launcher3.permission.WRITE_SETTINGS

np.۴

RestartSensor RestartConn android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_INFO android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER BOOT_COMPLETED1 android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_CHANGED android.hardware.usb.action.USB_STATE android.intent.action.WALLPAPER_CHANGED android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED

np.ा

android.app.action.DEVICE_ADMIN_ENABLED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Android Permissions

14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin

Permissions

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CAMERA

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.GET_PACKAGE_SIZE

android.permission.CALL_PHONE

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.USES_POLICY_FORCE_LOCK

android.permission.BATTERY_STATS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.REORDER_TASKS

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND

android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.QUERY_ALL_PACKAGES

android.permission.GET_INSTALLED_APPS

android.permission.POST_NOTIFICATIONS

android.permission.TURN_SCREEN_ON

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_AUDIO

android.permission.BLUETOOTH_CONNECT

com.vivo.permission.manage.permission.ACCESS

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

com.android.alarm.permission.SET_ALARM

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.CLEAR_APP_CACHE

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.VIBRATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.EXPAND_STATUS_BAR

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin

com.example.mysoul.OyvuMmuuuchbjm

np.ȉ

np.Γ

np.֦

np.ཪ

com.example.mysoul.QavwffgqjxRnisbafk

np.ီ

np.࿈

np.༐

np.ֳ

pub.devrel.easypermissions.ྤ

com.example.mysoul.BsbshbbeWaqoqbkkZptbnjp

np.ར

np.༩

np.ॽ

np.ɾ

np.ɿ

np.ఁ

np.྿

np.߸

np.้

np.ł

com.example.mysoul.YawhtukEfbybpgmo

np.ײ

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

np.۴

np.ा

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin

com.example.mysoul.OyvuMmuuuchbjm

np.ȉ

np.Γ

np.֦

np.ཪ

com.example.mysoul.QavwffgqjxRnisbafk

np.ီ

np.࿈

np.༐

np.ֳ

pub.devrel.easypermissions.ྤ

com.example.mysoul.BsbshbbeWaqoqbkkZptbnjp

np.ར

np.༩

np.ॽ

np.ɾ

np.ɿ

np.ఁ

np.྿

np.߸

np.้

np.ł

com.example.mysoul.YawhtukEfbybpgmo

np.ײ

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

np.۴

np.ा

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.startup.InitializationProvider

Android Permissions

14738acb5d7e082ef950f0d42af019fa5fa270959e9bf4b3474a1c68e7d88c28.bin