tgtoxic | 94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02[.]apk

General

Target
94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02.apk
Size 4.7MB
Sample250108-dbpyxasrem
SHA256 94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02
MD5 72a00302ea4abff775a0f5d64aa163d5
SHA1 a60c8d0605986f7069e36d637cbd001309801cb0
SHA512 30bd913dea1040f43890de4580c2ca6e2381fab87f2b962f38fd94a5184cea56c04fa29242c42bcf774120a97069dcc61fb1036f085d192f6428b869a6315985
SSDEEP 98304:U3mUMdkaoLKauoycvBMORRsc96MmXXYWL9RtNFk6P+xvDfDdI:U3mUEpauoFZf0c9pYRRtNH6lI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tgtoxic

Malware Config

Signatures

TgToxic payload 1 IoCs

resource	yara_rule
static1/unpack001/base.apk	family_tgtoxic

TgToxic_v2 payload 1 IoCs

resource	yara_rule
static1/unpack001/base.apk	family_tgtoxic_v2

Tgtoxic family
tgtoxic
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02.apk

.apk 4.7MB
base.apk

.apk 3.5MB

94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02.apk

SHA256 94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02
MD5 72a00302ea4abff775a0f5d64aa163d5
SHA1 a60c8d0605986f7069e36d637cbd001309801cb0
SHA512 30bd913dea1040f43890de4580c2ca6e2381fab87f2b962f38fd94a5184cea56c04fa29242c42bcf774120a97069dcc61fb1036f085d192f6428b869a6315985
SSDEEP 98304:U3mUMdkaoLKauoycvBMORRsc96MmXXYWL9RtNFk6P+xvDfDdI:U3mUEpauoFZf0c9pYRRtNH6lI
MD5 SHA1 SHA512 SSDEEP

android

com.mem.installdropsession

base.apk

SHA256 2bf76945694c257d9bb1533c70075fbabce2d8671b476b7478421389ed258980
MD5 fa8d37206d1d58c9803a01aca091a40f
SHA1 31d828b8fc6d0286eb2cb56ff49a464ecaf4c4e4
SHA512 f711906fc415bb67c1820bbf1b2f07cbc7d3a5ba59ddcbc1d94e3c490dd4bcdd9949ad4e68681150d627394de93a37fda2a02cf01aceac14f9db602656cf6371
SSDEEP 98304:D1y8VlJ807H8/jRRb4A1RtZLrqOfLDcjzn:Zy8V386H8PbptZL3zDc/n
MD5 SHA1 SHA512 SSDEEP

android

TgToxic payload
TgToxic_v2 payload

com.example.mysoul

android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.CAMERA android.permission.SYSTEM_ALERT_WINDOW android.permission.SYSTEM_OVERLAY_WINDOW android.permission.WAKE_LOCK android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.GET_PACKAGE_SIZE android.permission.CALL_PHONE android.permission.READ_PHONE_STATE android.permission.READ_CONTACTS android.permission.USES_POLICY_FORCE_LOCK android.permission.BATTERY_STATS android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.REORDER_TASKS android.permission.FOREGROUND_SERVICE android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND android.permission.REQUEST_INSTALL_PACKAGES android.permission.REQUEST_DELETE_PACKAGES android.permission.QUERY_ALL_PACKAGES android.permission.GET_INSTALLED_APPS android.permission.POST_NOTIFICATIONS android.permission.TURN_SCREEN_ON android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.READ_MEDIA_AUDIO android.permission.BLUETOOTH_CONNECT com.vivo.permission.manage.permission.ACCESS oppo.permission.OPPO_COMPONENT_SAFE com.huawei.permission.external_app_settings.USE_COMPONENT com.android.alarm.permission.SET_ALARM android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.CLEAR_APP_CACHE android.permission.ACCESS_NOTIFICATION_POLICY android.permission.VIBRATE android.permission.MODIFY_AUDIO_SETTINGS android.permission.EXPAND_STATUS_BAR android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.RECEIVE_USER_PRESENT com.android.launcher.permission.READ_SETTINGS com.android.launcher.permission.WRITE_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher2.permission.WRITE_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.android.launcher3.permission.WRITE_SETTINGS

np.ฺ

RestartSensor RestartConn android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_INFO android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER BOOT_COMPLETED1 android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_CHANGED android.hardware.usb.action.USB_STATE android.intent.action.WALLPAPER_CHANGED android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED

np.ึ

android.app.action.DEVICE_ADMIN_ENABLED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Android Permissions

94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02.apk

Permissions

android.permission.INTERNET

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REORDER_TASKS

android.permission.GET_PACKAGE_SIZE

android.permission.QUERY_ALL_PACKAGES

android.permission.GET_INSTALLED_APPS

Sharing

General

Malware Config

Signatures

File Explorer

94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02.apk

np.൉

androidx.startup.InitializationProvider

base.apk

com.example.mysoul.VdpuhpqbuChykVqywp

np.ۛ

np.ิ

np.ൗ

np.ൂ

com.example.mysoul.GjmcLjpj

np.ื

np.ี

np.ෘ

np.ั

pub.devrel.easypermissions.ဒ

com.example.mysoul.KkuuckoiurXffyJzogahtuxs

np.Γ

np.ෑ

np.ි

np.ෟ

np.ุ

np.ɿ

np.۴

np.ു

np.ඃ

np.߸

com.example.mysoul.NujilnPdjhfvsqjdXecxzhn

np.ී

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

np.ฺ

np.ึ

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.startup.InitializationProvider

Android Permissions

94694e56c6d22a0115a3dc615597f5e24a5f844fb5a250a4b71f673cfc2d0d02.apk