tgtoxic | 3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29[.]apk

General

Target
3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk
Size 4.8MB
Sample250113-w6fb3aspex
SHA256 3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29
MD5 d677c29a469041913c10e52193fd0d5e
SHA1 e8cf1650a6bbd93a93030d641ababe2677ab5bad
SHA512 bd4e3e006c5e14ac05cd3312202440d708d4f1c4550853dc370a7605fbc5d6a5ae07a5fcc56a66b77e398297130a1100eb592b8a092494def5a66ac4c3da8403
SSDEEP 98304:u3mUMdkaoLKauoXy/1CHceA8PehYttGrcKvvJO+g:u3mUEpauoXaw7A8PCYt6c4v/g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tgtoxic

Malware Config

Signatures

TgToxic payload 1 IoCs

resource	yara_rule
static1/unpack001/base.apk	family_tgtoxic

TgToxic_v2 payload 1 IoCs

resource	yara_rule
static1/unpack001/base.apk	family_tgtoxic_v2

Tgtoxic family
tgtoxic
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk

.apk 4.8MB
base.apk

.apk 3.6MB

3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk

SHA256 3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29
MD5 d677c29a469041913c10e52193fd0d5e
SHA1 e8cf1650a6bbd93a93030d641ababe2677ab5bad
SHA512 bd4e3e006c5e14ac05cd3312202440d708d4f1c4550853dc370a7605fbc5d6a5ae07a5fcc56a66b77e398297130a1100eb592b8a092494def5a66ac4c3da8403
SSDEEP 98304:u3mUMdkaoLKauoXy/1CHceA8PehYttGrcKvvJO+g:u3mUEpauoXaw7A8PCYt6c4v/g
MD5 SHA1 SHA512 SSDEEP

android

com.mem.installdropsession

base.apk

SHA256 9d00052eb9a97a53a49c8e1a26138de835e2d354adef44a51ce8fb599d769fc1
MD5 aca88829c5a7c2f7ab8ae928f3df9fda
SHA1 2ef0057ce7fa7d3c27d894b5ee0532a4b9f62f10
SHA512 44982081663f363769d16f667a229a36d2069678cb3177ce4e45e299f424566f9eeb71779afed2e93f67ae3cbcf04cd8b3c8b736f4981f5a937ce08392770fbc
SSDEEP 49152:+bgW8wiy8Vp7mZtgAWDGo2ZO5eAgBNx6yyhfYPdIxAH0fRnJfzvvR93Ueg6b/4o:+W1y8Vpug3t0AUyhQ2fbLP3hg6R
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm

TgToxic payload
TgToxic_v2 payload

com.example.mysoul

android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.CAMERA android.permission.SYSTEM_ALERT_WINDOW android.permission.WAKE_LOCK android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.GET_PACKAGE_SIZE android.permission.CALL_PHONE android.permission.READ_PHONE_STATE android.permission.READ_CONTACTS android.permission.USES_POLICY_FORCE_LOCK android.permission.BATTERY_STATS android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.REORDER_TASKS android.permission.FOREGROUND_SERVICE android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND android.permission.REQUEST_INSTALL_PACKAGES android.permission.REQUEST_DELETE_PACKAGES android.permission.QUERY_ALL_PACKAGES android.permission.GET_INSTALLED_APPS android.permission.POST_NOTIFICATIONS android.permission.TURN_SCREEN_ON android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.MANAGE_ALL_FILES_ACCESS_PERMISSION android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.READ_MEDIA_AUDIO android.permission.BLUETOOTH_CONNECT com.vivo.permission.manage.permission.ACCESS oppo.permission.OPPO_COMPONENT_SAFE com.huawei.permission.external_app_settings.USE_COMPONENT com.android.alarm.permission.SET_ALARM android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.CLEAR_APP_CACHE android.permission.ACCESS_NOTIFICATION_POLICY android.permission.VIBRATE android.permission.MODIFY_AUDIO_SETTINGS android.permission.EXPAND_STATUS_BAR android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.RECEIVE_USER_PRESENT com.android.launcher.permission.READ_SETTINGS com.android.launcher.permission.WRITE_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher2.permission.WRITE_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.android.launcher3.permission.WRITE_SETTINGS

np.ࣿ

RestartSensor RestartConn android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICK_INFO android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER BOOT_COMPLETED1 android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_CHANGED android.hardware.usb.action.USB_STATE android.intent.action.WALLPAPER_CHANGED android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED

np.࣠

android.app.action.DEVICE_ADMIN_ENABLED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Android Permissions

3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk

Permissions

android.permission.INTERNET

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REORDER_TASKS

android.permission.GET_PACKAGE_SIZE

android.permission.QUERY_ALL_PACKAGES

android.permission.GET_INSTALLED_APPS

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk

np.൉

androidx.startup.InitializationProvider

base.apk

com.example.mysoul.PluibMwzyirystm

np.ॗ

np.࣏

np.࣍

np.࣒

com.example.mysoul.VajlBmlnofv

np.ࣷ

np.࣐

np.ࣳ

np.ࣶ

pub.devrel.easypermissions.ၒ

com.example.mysoul.XktfWwejoufTkstap

np.ࣟ

np.ࣙ

np.࣑

np.ࣛ

np.࣌

np.ࣴ

np.ऺ

np.ࣚ

np.ࣼ

np.ࣸ

com.example.mysoul.JfduykshobXxueae

np.ࣞ

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

np.ࣿ

np.࣠

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.startup.InitializationProvider

Android Permissions

3d52b5728af55c37d5bd74c3f9b7e9ea6b007a9ec202a648ce3dc7e37ff49b29.apk