6ff3487c5673019eab65113ba276840782d0ee1592cef706dec5a5cab1782b45

General

Target

no_dropper.apk
Size

3.5MB
MD5

7c025fae6cac4e607f7eca2173d2f258
SHA1

96275877209ae6cdbce7b6e855d2add26e8e1fff
SHA256

6ff3487c5673019eab65113ba276840782d0ee1592cef706dec5a5cab1782b45
SHA512

daa4fd6a60d4092c27acae325339c3313548d5edf7076cad51dabcc7b1607e7474c090969bc48783bf76bbb1027242929000d7c1a3029646884e29ae8817f524
SSDEEP

98304:r1y8VlJ8Q7H8/jRRb4A1RtZLrqOfLDcjzf:xy8V382H8PbptZL3zDc/f

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5164

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5270

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5342

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5396

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5454

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5526

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
18eda1ac6e120ca8a5c91507fbdcc1d3

SHA1
91401c6706ecdfc2f7a1d449e7b2cb27643e398e

SHA256
fe6c0c5c4a04ed7c46a5095d3b2ad55699cc90e70794ba958c5daa213c6494a7

SHA512
52f0d7b7f3e65b4de6ba9067febe61e5f76d8bcba1f5893e9cf30be3e168d88761ee58665e79d04932cb74314a886d0869e2c7dd32f96688e4ac85dcb92069fa

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2989122093e776a9aa7ca0dc82a93c28

SHA1
beb34f4b276e7c233891b643ea1c471b74321ac1

SHA256
0401d10929f655a94573fbdb5d5aa284c1b29834af4d8d7c81d194c0ad29598d

SHA512
c43fdf21210ff4e6852268b62516d5a2717d7815520fc0c37ffb225827b6c7127128b3c675d2269c648ecdf72f9d31b49168508c9dcf6394e634574505bb6b37

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
e4cb8d92ad84bb43687e9c10641bba21

SHA1
7ce84026f9cc05c487394a29bf51b52967415fff

SHA256
41703ea27814de1a1db2f10bd663047575070186c65e706bff047481474b294f

SHA512
aeaa8dfc77e43516ef09b4706ac48ba5bba86a55b21e2713f6467eca246f6ea748520eb513ab5268b2751e695027930c4894214ed61f61c49067a0885aa3b011

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads