fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676

General

Target

fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
Size

3.5MB
MD5

4defa7e71f97180dd679875060b2188a
SHA1

351c7ed45a11b9fea142c40484d51b56a7084061
SHA256

fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676
SHA512

53e7d453799ca9457bafa0643c6fa36f6f2095a81f081286c714545084328bdc5b3f7e23c511465f5886689bbb673f7ef4646287b76c1021eab226d24f31f6d3
SSDEEP

98304:21y8VlJ8f7H8/jRRb4A1RtZLrqOfLDcjzm:ay8V38zH8PbptZL3zDc/m

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4969

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5118

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5203

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5256

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5316

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5491

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
f6601d1e9d0553fe278fcdcefc278c7c

SHA1
745ac15fab28ed519e7a9a566a372fc56ed4ae23

SHA256
24a53633d1a1b8f33e63f29181ea12005bc23c69da48a56d8299a5106000618d

SHA512
72823c9b3a5a3db284411159b2fc61297d14f4f1407c9ab95dbd47d9ca9a64f7b72260c2f8d38856045528b23804457bb7b0eb9719b1453dc1b1f49989eaf029

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
108KB

MD5
94d22a0923bbfda52d74a04529aa43e7

SHA1
eca5eace743876d4c314b4ab538a491f1d71d41d

SHA256
c10847ab955ebd2037beffc2680da957c6ae7c4e79cc1565cf08e02cf7e6f644

SHA512
7f471bf57a8763f4e2e3738ec151f28ff509d525a5b50939f47d93f0fa98f477814a26cfe1681f74a1affb5151994d9519463aceef712270db2ba1c1ea92c95f

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
32KB

MD5
8327f2a8de5cb6c7d54ac0561d5a9539

SHA1
dae947bd1fcf0596cac175329e108b6daf3857e9

SHA256
580c3d75f68c139d66f2550fb9e157243278ad8ece225cd5898a47ad915e1d05

SHA512
27d5f8039cc312d2d6715f47ec1bf83701d47cd285a511a60b31094d09bf4dcda6289ac2bb5dc3d1b6e902d684b5d0b9441eef7404a995ddfc95f627e71539c8

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
52KB

MD5
b75aec8a1e95dbe48c186f239a822cce

SHA1
9be239ead8f2eb197462cbe5e9db2363a5fa50a0

SHA256
1467263427c43960ffd7e8b8ffc7636b5539ad2f88aafea11697a477748fd64d

SHA512
5f1a4a18a4d3d03429e3afdcfb848fb41b23ee724e8bdabb36a611c49a475de4a9bc0c3bf8933a1eae2437a227a24cf439a51437f1b75a0051a0485d55f5668c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads