6ff3487c5673019eab65113ba276840782d0ee1592cef706dec5a5cab1782b45

General

Target
no_dropper.apk
Size 3.5MB
Sample250107-ne55ea1jhm
SHA256 6ff3487c5673019eab65113ba276840782d0ee1592cef706dec5a5cab1782b45
MD5 7c025fae6cac4e607f7eca2173d2f258
SHA1 96275877209ae6cdbce7b6e855d2add26e8e1fff
SHA512 daa4fd6a60d4092c27acae325339c3313548d5edf7076cad51dabcc7b1607e7474c090969bc48783bf76bbb1027242929000d7c1a3029646884e29ae8817f524
SSDEEP 98304:r1y8VlJ8Q7H8/jRRb4A1RtZLrqOfLDcjzf:xy8V382H8PbptZL3zDc/f
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5164

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5270

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5342

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5396

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5454

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5526

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 fe6c0c5c4a04ed7c46a5095d3b2ad55699cc90e70794ba958c5daa213c6494a7
MD5 18eda1ac6e120ca8a5c91507fbdcc1d3
SHA1 91401c6706ecdfc2f7a1d449e7b2cb27643e398e
SHA512 52f0d7b7f3e65b4de6ba9067febe61e5f76d8bcba1f5893e9cf30be3e168d88761ee58665e79d04932cb74314a886d0869e2c7dd32f96688e4ac85dcb92069fa
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 0401d10929f655a94573fbdb5d5aa284c1b29834af4d8d7c81d194c0ad29598d
MD5 2989122093e776a9aa7ca0dc82a93c28
SHA1 beb34f4b276e7c233891b643ea1c471b74321ac1
SHA512 c43fdf21210ff4e6852268b62516d5a2717d7815520fc0c37ffb225827b6c7127128b3c675d2269c648ecdf72f9d31b49168508c9dcf6394e634574505bb6b37
SSDEEP 12:KyJkwSJkcTzdTRmBEyPbP/IJk43yuE6uJOw2:KyJsJvzyGSP/IJN3AR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 41703ea27814de1a1db2f10bd663047575070186c65e706bff047481474b294f
MD5 e4cb8d92ad84bb43687e9c10641bba21
SHA1 7ce84026f9cc05c487394a29bf51b52967415fff
SHA512 aeaa8dfc77e43516ef09b4706ac48ba5bba86a55b21e2713f6467eca246f6ea748520eb513ab5268b2751e695027930c4894214ed61f61c49067a0885aa3b011
SSDEEP 96:l+6+hdjnHtDRMpf8UzS6+BD8q0ExPw37Ex0N/WLY03cOLW99R9l5OH:MdjnHt9Mpf8UzS6+BD8q0E5ZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads