3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29

Resubmissions

13-01-2025 18:31

250113-w6fb3aspex 10

14-12-2024 03:13

241214-dqtweatjhv 10

Analysis

max time kernel
31s
max time network
84s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
13-01-2025 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

3.6MB
MD5

aca88829c5a7c2f7ab8ae928f3df9fda
SHA1

2ef0057ce7fa7d3c27d894b5ee0532a4b9f62f10
SHA256

9d00052eb9a97a53a49c8e1a26138de835e2d354adef44a51ce8fb599d769fc1
SHA512

44982081663f363769d16f667a229a36d2069678cb3177ce4e45e299f424566f9eeb71779afed2e93f67ae3cbcf04cd8b3c8b736f4981f5a937ce08392770fbc
SSDEEP

49152:+bgW8wiy8Vp7mZtgAWDGo2ZO5eAgBNx6yyhfYPdIxAH0fRnJfzvvR93Ueg6b/4o:+W1y8Vpug3t0AUyhQ2fbLP3hg6R

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4259

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c0585b1bc4d02b5b320864668b3ab879

SHA1
2d2f31bf1993dca31f1a5f3c3fd10bb13b4445c1

SHA256
679fa8314afb0ba0951aa2c10121618ac4a797115cba59963027292ebfed031e

SHA512
6636923048ef3d84d28fc6132f9eec0736af8e43c71d081f453ea6a3cb1d22ccb03f6d49066c972e1a7e78d8ebae497fcf624f47bc53945aa0e4dfa815923bdc

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
57ef3033f10c4193f58b3942f19dcaf4

SHA1
01740797a5358cc4fa63e528d8d932f5bd16cbbb

SHA256
f89bdfa10fbb5a6bab0555895d83c895863b4be8be4d9d6a5795518a61a7891b

SHA512
fc9c30aa2c3f0b1346637e49f5600aa970c9f1431a312264a8e7921da1b51e2ca24338159399327bbd5855411fb4a7514e36e2d47ee7aec66bddef6c0c08d574

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
0f3acffd756c59100cb66b9c328c39b2

SHA1
21af21568f14fca32d910596fcb4139bda2d12d0

SHA256
56cfa258fcc00aef7a11d1298b1fac70e43f71cefc10d8a0a11148ba661986a2

SHA512
8f72376c1b20cdb1079e6e1e04e47cebf981fa356ca444aea436dc83426e6cd7d66baf5fe021f450662275922becf5de34f7185f6ec99aef8cea7e44e40bfe88

Download Submit