94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02

General

Target
base.apk
Size 3.5MB
Sample250108-dbpyxasrem
SHA256 2bf76945694c257d9bb1533c70075fbabce2d8671b476b7478421389ed258980
MD5 fa8d37206d1d58c9803a01aca091a40f
SHA1 31d828b8fc6d0286eb2cb56ff49a464ecaf4c4e4
SHA512 f711906fc415bb67c1820bbf1b2f07cbc7d3a5ba59ddcbc1d94e3c490dd4bcdd9949ad4e68681150d627394de93a37fda2a02cf01aceac14f9db602656cf6371
SSDEEP 98304:D1y8VlJ807H8/jRRb4A1RtZLrqOfLDcjzn:Zy8V386H8PbptZL3zDc/n
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4256
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4284

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:4328
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4393

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4418

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4477

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4559
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4587

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4690

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b281c48c705fefded044ba829cfc398d2862c1500968f4951e68a97abbc02726
MD5 f6b09cce47cbce4399fa3149f5c734fd
SHA1 7adbf7ee83fda3a789441a1ebed18dee80f7bd23
SHA512 cfc2bb543bae8354b9e6a7348a50b193f0ce4b98578928c88bed51e9ed5ffcfda34127c971289151c6402b6448918d758b950ed457cbb82bc96087e8e444e6f2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm
Size 108KB
SHA256 504cc39b74ec62b843503dc4119f8332926ebd3d87c3f034024118603eb0bc7b
MD5 28cea4ca7384d826376beeaeed844b07
SHA1 592f303b18f65c3eb471be8f9a6102c46d7d1307
SHA512 4b343facafd9467b58a2ee59ab715c4050467489f5afd45ae8918e6011a3970f3e3b32be27674814d4c3a776e65a5c298f699c3743ab52bbdb36e67c3b1c1073
SSDEEP 96:id6+hdjnHtDRMpf8UzS6+BD8q0ExPgeSVH:ihdjnHt9Mpf8UzS6+BD8q0E5geu
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 32KB
SHA256 def540f21a04ad7ab498ffae6eee70e3977dd3200d30f20acc230bcf78c7f455
MD5 3cd548c6595ce315da2dbcde6f9afb46
SHA1 6ad1af6307953b96ba424ecfe316e773a216948c
SHA512 5c264c50705f8b5478ec16bf10a838e4ff007049642cf684c6089b1686d8b43032ffce521310f7e3de998311d810d1f01c520cafd1d26df7b8079f649574759e
SSDEEP 6:K69+Av9FZdrlOERX4zj4ogLugMBX4suuK+/rlMX3ViOwCl:KXCzdTRswyPbP/8iOwCl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads