fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676

General

Target
fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676.apk
Size 3.5MB
Sample250108-dv4amstqdm
SHA256 fde931224d2e558e67ac8c9c0c1d0aac4f7562622a67870d6c3024bdeb851676
MD5 4defa7e71f97180dd679875060b2188a
SHA1 351c7ed45a11b9fea142c40484d51b56a7084061
SHA512 53e7d453799ca9457bafa0643c6fa36f6f2095a81f081286c714545084328bdc5b3f7e23c511465f5886689bbb673f7ef4646287b76c1021eab226d24f31f6d3
SSDEEP 98304:21y8VlJ8f7H8/jRRb4A1RtZLrqOfLDcjzm:ay8V38zH8PbptZL3zDc/m
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4969

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5118

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5203

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5256

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5316

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5491

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 24a53633d1a1b8f33e63f29181ea12005bc23c69da48a56d8299a5106000618d
MD5 f6601d1e9d0553fe278fcdcefc278c7c
SHA1 745ac15fab28ed519e7a9a566a372fc56ed4ae23
SHA512 72823c9b3a5a3db284411159b2fc61297d14f4f1407c9ab95dbd47d9ca9a64f7b72260c2f8d38856045528b23804457bb7b0eb9719b1453dc1b1f49989eaf029
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm
Size 108KB
SHA256 c10847ab955ebd2037beffc2680da957c6ae7c4e79cc1565cf08e02cf7e6f644
MD5 94d22a0923bbfda52d74a04529aa43e7
SHA1 eca5eace743876d4c314b4ab538a491f1d71d41d
SHA512 7f471bf57a8763f4e2e3738ec151f28ff509d525a5b50939f47d93f0fa98f477814a26cfe1681f74a1affb5151994d9519463aceef712270db2ba1c1ea92c95f
SSDEEP 96:H6+hdjnHtDRMpf8UzS6+BD8q0ExPsqiFoNF:/djnHt9Mpf8UzS6+BD8q0E5sV8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 32KB
SHA256 580c3d75f68c139d66f2550fb9e157243278ad8ece225cd5898a47ad915e1d05
MD5 8327f2a8de5cb6c7d54ac0561d5a9539
SHA1 dae947bd1fcf0596cac175329e108b6daf3857e9
SHA512 27d5f8039cc312d2d6715f47ec1bf83701d47cd285a511a60b31094d09bf4dcda6289ac2bb5dc3d1b6e902d684b5d0b9441eef7404a995ddfc95f627e71539c8
SSDEEP 6:K5aTipt9FZdrlOERX4zj4ogLugMBX4suuK+/v+Z2HhxQ4OwCl:KkUzdTRswyPbP/v+ZGg4OwCl
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal
Size 52KB
SHA256 1467263427c43960ffd7e8b8ffc7636b5539ad2f88aafea11697a477748fd64d
MD5 b75aec8a1e95dbe48c186f239a822cce
SHA1 9be239ead8f2eb197462cbe5e9db2363a5fa50a0
SHA512 5f1a4a18a4d3d03429e3afdcfb848fb41b23ee724e8bdabb36a611c49a475de4a9bc0c3bf8933a1eae2437a227a24cf439a51437f1b75a0051a0485d55f5668c
SSDEEP 48:s9Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI98:q6+hdjnHtDRMpf8UzS6+BD8q0ExP3hw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads