Resubmissions
13-01-2025 15:53
250113-tb1cmszmdj 1013-01-2025 15:48
250113-s8783szlen 1013-01-2025 15:45
250113-s683laxmby 10Analysis
-
max time kernel
65s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
13-01-2025 15:45
General
-
Target
085d7e2fafc8b6aad0bd0e8361c5dae7249afa34ebd43d66278af27ace60b238.apk
-
Size
3.5MB
-
MD5
2be0c2b438dbc8dd89c0ed34db466f7d
-
SHA1
c795e972b09cb5a15e7e30ab6d6faad88aafc678
-
SHA256
085d7e2fafc8b6aad0bd0e8361c5dae7249afa34ebd43d66278af27ace60b238
-
SHA512
0cef57fff738ed45833b3d4ea657b71a329b5c8fc1206be680ed33490537621c1654e15cfaf687de20be0d2fb8181630fb12e18ba4e49602f234efe624f6bfce
-
SSDEEP
98304:3Z1IWbE4aPTHP5J2P2R1pozWaLIXf9Y6NJgd2ofrZD1y889wL:3LZFqTHP/2YjozWUIXfO6Puy889wL
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 10 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 5 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 2 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD535f7d0da45ae66ce3c7eb60a8ddb5074
SHA1e4f5ab07020086a174cfcf06e57b8c7b5b4a7388
SHA2561e2dfc7ff4b27f8ec390e4f05d59a27a10fbcb0bc1576b4216e1299e5a3acf9c
SHA512206a55f129b84c3f0fcfa8bad37b6be34e337449cd866524512b632477cc6ce2a50f53126c61a64a1cc9a2ddefe81b6208113a2c94b0f74f26739216d238bd37
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD51caef46eb4f0c413c4e968a55a36c8a4
SHA15097bc5b5a8e7c58df38a467aaaea2e4dd407bbc
SHA256f8f94eb3a39ec53a9edaed2b17cdae143c5baecb7ce95a1a92069d933c7639a7
SHA51284bb19eff04f2fb2dcb50e1d57e95aa9319aa6bdaf070c05162711dde94882dcd47cd3b46591f6ae90df0c1f9ebaeeb615c3395c9dbbd0d6c495ded72b718e35
-
Filesize
108KB
MD5f38441c1956f4060759937e70c6c00f8
SHA1bbaf8586d4aea759fb0ca2fe0c72e38845462f0d
SHA256bca198184910d0be9f57cde7240cca3a884f51905d9ef805dc9694938644f8c4
SHA5127b8f12b1c459f58cb6db21a3f49f7503c0ac9ccfdcef53b3601d0278d254b0194f7d7a6de414ff5a9f10592156db8ade0e3c15daf597d792e1354dbb73b9ad3f