Resubmissions
13-01-2025 15:53
250113-tb1cmszmdj 1013-01-2025 15:48
250113-s8783szlen 1013-01-2025 15:45
250113-s683laxmby 10Analysis
-
max time kernel
66s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
13-01-2025 15:45
General
-
Target
085d7e2fafc8b6aad0bd0e8361c5dae7249afa34ebd43d66278af27ace60b238.apk
-
Size
3.5MB
-
MD5
2be0c2b438dbc8dd89c0ed34db466f7d
-
SHA1
c795e972b09cb5a15e7e30ab6d6faad88aafc678
-
SHA256
085d7e2fafc8b6aad0bd0e8361c5dae7249afa34ebd43d66278af27ace60b238
-
SHA512
0cef57fff738ed45833b3d4ea657b71a329b5c8fc1206be680ed33490537621c1654e15cfaf687de20be0d2fb8181630fb12e18ba4e49602f234efe624f6bfce
-
SSDEEP
98304:3Z1IWbE4aPTHP5J2P2R1pozWaLIXf9Y6NJgd2ofrZD1y889wL:3LZFqTHP/2YjozWUIXfO6Puy889wL
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 10 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 5 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 2 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 4 IoCs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD57556e7c6ce1abd034e9e1a0f4193219b
SHA1fbee5fe6370d2e196ded367b5dd484ba7b72159f
SHA256e5e6535f6ba59f2431b8e502eee8006ab3adb187c4ae72d27c57c7c53e8e42c0
SHA51237f40da62438b6abd96e5c28d361ba9714a7a0e3a4bcda1aba41f6def65715d0561fbd938a7f445952dee3ffa6d8857a62efb126867c49f762b7021011e9c010
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
28KB
MD5e4e0d48d29911fad4f9aa366531d6e1f
SHA1c644c3a79620a694a79d148ba796662e3959e5b0
SHA256d1691095479656c438ec239b66f71c661cb7026a8e8827d796e5f6a88275b1e3
SHA51254893f1807de29707c6f9a492d79792fb8838ededca2652699f2d0b23813bde543433033aca725152a8f0bf16226a79dd0ec3a97d4382305cd8a85f418d9ab30
-
Filesize
108KB
MD54775af7327360f40b7b8ffd3d597baf2
SHA1c9a5364d66cc7631261c4495c0e871dae985e0af
SHA2561ea9fc35229202b5a1d2b4bc6a455b527d9f3a54659c06e3b89c2f9612455e2b
SHA512807f49c5b6ebdfbaad05b96a15b6411de7c7fecc2fa7702a3e51fcd729a7c378b3ab2508a2045d91588a7a90b5e9321b23853c57b9c242bb7b65826044c5cec8