94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02

General

Target
base.apk
Size 3.5MB
Sample250108-dbpyxasrem
SHA256 2bf76945694c257d9bb1533c70075fbabce2d8671b476b7478421389ed258980
MD5 fa8d37206d1d58c9803a01aca091a40f
SHA1 31d828b8fc6d0286eb2cb56ff49a464ecaf4c4e4
SHA512 f711906fc415bb67c1820bbf1b2f07cbc7d3a5ba59ddcbc1d94e3c490dd4bcdd9949ad4e68681150d627394de93a37fda2a02cf01aceac14f9db602656cf6371
SSDEEP 98304:D1y8VlJ807H8/jRRb4A1RtZLrqOfLDcjzn:Zy8V386H8PbptZL3zDc/n
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4928

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5080

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5167

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5221

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5279

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5437

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 cf1f7f521965e585c8269375cfbefc22158bcad0194f372820ca734533e03bab
MD5 dcc4bfb1978257f73b54125cb68ad34f
SHA1 a40c97e35e3ac736ac2c51c59e3c3c03d5970c06
SHA512 e5cb518681de55f342bd905800bb9a2322fc603f4b2c6dfb75b314bee433d8a4b42b6843aaeb49d6d90e2111062e673bd46065752917965d7854dda92a83b6db
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 32KB
SHA256 9e32a30be792644146cc768929aac981aa78ce27a908e1cfa5185d0f743a5141
MD5 52c6940b595547b4a857ca6f7308d2c3
SHA1 79fb4a44230d64ba846b023b94ef5a19cdfab256
SHA512 4d8f0089d501d184f467a4ee8670b21b7f293d7f515c03e7da5b2080b872d4c83af7aee8ffe23b802b82c33c76769d1e3752237eedce2c119a9884344650cdd5
SSDEEP 6:KgfU+v9FZdrlOERX4zj4ogLugMBX4suuK+/0nt2irW4vAWOwCl:KgfxlzdTRswyPbP/0IIW4vAWOwCl
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 7a8f7cb8e0ff633231716d4b98e0a185e7808eeb661e1d28e625b8b27a2dc1f9
MD5 8b77e45914562e71d211572a408f9517
SHA1 f065b46a78472217fa494c6d1e4fa18f68904557
SHA512 18a8ecd79f00d1a58cdf449813388ea6a314332f3b83e4bf3abf04a8e16909d666bb40dd7783c74b4910abb443103f7099b1a90a46d29080e1e289bd06f6e5bb
SSDEEP 96:c6+hdjnHtDRMpf8UzS6+BD8q0ExPhRcol8S:YdjnHt9Mpf8UzS6+BD8q0E5hGolz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads