tgtoxic

General

Target
3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk
Size 4.8MB
Sample250113-w6fb3aspex
SHA256 3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29
MD5 d677c29a469041913c10e52193fd0d5e
SHA1 e8cf1650a6bbd93a93030d641ababe2677ab5bad
SHA512 bd4e3e006c5e14ac05cd3312202440d708d4f1c4550853dc370a7605fbc5d6a5ae07a5fcc56a66b77e398297130a1100eb592b8a092494def5a66ac4c3da8403
SSDEEP 98304:u3mUMdkaoLKauoXy/1CHceA8PehYttGrcKvvJO+g:u3mUEpauoXaw7A8PCYt6c4v/g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk
- Size 4.8MB
- SHA256 3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29
- MD5 d677c29a469041913c10e52193fd0d5e
- SHA1 e8cf1650a6bbd93a93030d641ababe2677ab5bad
- SHA512 bd4e3e006c5e14ac05cd3312202440d708d4f1c4550853dc370a7605fbc5d6a5ae07a5fcc56a66b77e398297130a1100eb592b8a092494def5a66ac4c3da8403
- SSDEEP 98304:u3mUMdkaoLKauoXy/1CHceA8PehYttGrcKvvJO+g:u3mUEpauoXaw7A8PCYt6c4v/g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  base.apk
- Size 3.6MB
- SHA256 9d00052eb9a97a53a49c8e1a26138de835e2d354adef44a51ce8fb599d769fc1
- MD5 aca88829c5a7c2f7ab8ae928f3df9fda
- SHA1 2ef0057ce7fa7d3c27d894b5ee0532a4b9f62f10
- SHA512 44982081663f363769d16f667a229a36d2069678cb3177ce4e45e299f424566f9eeb71779afed2e93f67ae3cbcf04cd8b3c8b736f4981f5a937ce08392770fbc
- SSDEEP 49152:+bgW8wiy8Vp7mZtgAWDGo2ZO5eAgBNx6yyhfYPdIxAH0fRnJfzvvR93Ueg6b/4o:+W1y8Vpug3t0AUyhQ2fbLP3hg6R
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

tgtoxic banker collection credential_access discovery evasion execution impact infostealer persistence trojan
- TgToxic
  TgToxic is an Android banking trojan first seen in July 2022.
  infostealer trojan banker tgtoxic
- Tgtoxic family
  tgtoxic
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral4 behavioral5 behavioral6