tgtoxic | no_dropper[.]apk

General

Target
no_dropper.apk
Size 3.5MB
Sample250107-ne55ea1jhm
SHA256 6ff3487c5673019eab65113ba276840782d0ee1592cef706dec5a5cab1782b45
MD5 7c025fae6cac4e607f7eca2173d2f258
SHA1 96275877209ae6cdbce7b6e855d2add26e8e1fff
SHA512 daa4fd6a60d4092c27acae325339c3313548d5edf7076cad51dabcc7b1607e7474c090969bc48783bf76bbb1027242929000d7c1a3029646884e29ae8817f524
SSDEEP 98304:r1y8VlJ8Q7H8/jRRb4A1RtZLrqOfLDcjzf:xy8V382H8PbptZL3zDc/f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tgtoxic

Malware Config

Signatures

TgToxic payload 1 IoCs

resource	yara_rule
sample	family_tgtoxic

TgToxic_v2 payload 1 IoCs

resource	yara_rule
sample	family_tgtoxic_v2

Tgtoxic family
tgtoxic
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 20 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

File Explorer

no_dropper.apk

.apk 3.5MB

no_dropper.apk

SHA256 6ff3487c5673019eab65113ba276840782d0ee1592cef706dec5a5cab1782b45
MD5 7c025fae6cac4e607f7eca2173d2f258
SHA1 96275877209ae6cdbce7b6e855d2add26e8e1fff
SHA512 daa4fd6a60d4092c27acae325339c3313548d5edf7076cad51dabcc7b1607e7474c090969bc48783bf76bbb1027242929000d7c1a3029646884e29ae8817f524
SSDEEP 98304:r1y8VlJ8Q7H8/jRRb4A1RtZLrqOfLDcjzf:xy8V382H8PbptZL3zDc/f
MD5 SHA1 SHA512 SSDEEP

android

TgToxic payload
TgToxic_v2 payload

com.example.mysoul

android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.CAMERA android.permission.SYSTEM_ALERT_WINDOW android.permission.SYSTEM_OVERLAY_WINDOW android.permission.WAKE_LOCK android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.GET_PACKAGE_SIZE android.permission.CALL_PHONE android.permission.READ_PHONE_STATE android.permission.READ_CONTACTS android.permission.USES_POLICY_FORCE_LOCK android.permission.BATTERY_STATS android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.REORDER_TASKS android.permission.FOREGROUND_SERVICE android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND android.permission.REQUEST_INSTALL_PACKAGES android.permission.REQUEST_DELETE_PACKAGES android.permission.QUERY_ALL_PACKAGES android.permission.GET_INSTALLED_APPS android.permission.POST_NOTIFICATIONS android.permission.TURN_SCREEN_ON android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.READ_MEDIA_AUDIO android.permission.BLUETOOTH_CONNECT com.vivo.permission.manage.permission.ACCESS oppo.permission.OPPO_COMPONENT_SAFE com.huawei.permission.external_app_settings.USE_COMPONENT com.android.alarm.permission.SET_ALARM android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.CLEAR_APP_CACHE android.permission.ACCESS_NOTIFICATION_POLICY android.permission.VIBRATE android.permission.MODIFY_AUDIO_SETTINGS android.permission.EXPAND_STATUS_BAR android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.RECEIVE_USER_PRESENT com.android.launcher.permission.READ_SETTINGS com.android.launcher.permission.WRITE_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher2.permission.WRITE_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.android.launcher3.permission.WRITE_SETTINGS

np.ฺ

RestartSensor RestartConn android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_INFO android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER BOOT_COMPLETED1 android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_CHANGED android.hardware.usb.action.USB_STATE android.intent.action.WALLPAPER_CHANGED android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED

np.ึ

android.app.action.DEVICE_ADMIN_ENABLED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Android Permissions

no_dropper.apk

Permissions

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CAMERA

android.permission.SYSTEM_ALERT_WINDOW

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.GET_PACKAGE_SIZE

android.permission.CALL_PHONE

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.USES_POLICY_FORCE_LOCK

android.permission.BATTERY_STATS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.REORDER_TASKS

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND

android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.QUERY_ALL_PACKAGES

android.permission.GET_INSTALLED_APPS

android.permission.POST_NOTIFICATIONS

android.permission.TURN_SCREEN_ON

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_AUDIO

android.permission.BLUETOOTH_CONNECT

com.vivo.permission.manage.permission.ACCESS

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT

com.android.alarm.permission.SET_ALARM

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.CLEAR_APP_CACHE

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.VIBRATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.EXPAND_STATUS_BAR

android.permission.SCHEDULE_EXACT_ALARM

no_dropper.apk

com.example.mysoul.VdpuhpqbuChykVqywp

np.ۛ

np.ิ

np.ൗ

np.ൂ

com.example.mysoul.GjmcLjpj

np.ื

np.ี

np.ෘ

np.ั

pub.devrel.easypermissions.ဒ

com.example.mysoul.KkuuckoiurXffyJzogahtuxs

np.Γ

np.ෑ

np.ි

np.ෟ

np.ุ

np.ɿ

np.۴

np.ു

np.ඃ

np.߸

com.example.mysoul.NujilnPdjhfvsqjdXecxzhn

np.ී

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

np.ฺ

np.ึ

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

no_dropper.apk

com.example.mysoul.VdpuhpqbuChykVqywp

np.ۛ

np.ิ

np.ൗ

np.ൂ

com.example.mysoul.GjmcLjpj

np.ื

np.ี

np.ෘ

np.ั

pub.devrel.easypermissions.ဒ

com.example.mysoul.KkuuckoiurXffyJzogahtuxs

np.Γ

np.ෑ

np.ි

np.ෟ

np.ุ

np.ɿ

np.۴

np.ു

np.ඃ

np.߸

com.example.mysoul.NujilnPdjhfvsqjdXecxzhn

np.ී

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

np.ฺ

np.ึ

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.startup.InitializationProvider

Android Permissions

no_dropper.apk