faca6f37c60a21804ad72938553da070f7641bad0a29084da9babfa22e495be6

Resubmissions

13-01-2025 18:05

250113-wn9g7asjat 10

13-01-2025 18:02

250113-wmhyvatpgp 10

Analysis

max time kernel
32s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13-01-2025 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faca6f37c60a21804ad72938553da070f7641bad0a29084da9babfa22e495be6.apk
Size

3.7MB
MD5

0fde05a59f67cf457fb60b55793e8cb6
SHA1

de648669eb42fc30c300615de65922fd1a01a166
SHA256

faca6f37c60a21804ad72938553da070f7641bad0a29084da9babfa22e495be6
SHA512

7d1e643febdf2a45fefa78f5be947834a637883a1adad3b8cbe5bf89c1fd6acd5d99b1b67df89799d03a44961cc6adb16ba298a9c4d896aaa81a7edada098047
SSDEEP

98304:dz1y8VQyJ8pVZflV3BdXs0DDVaLccrz8e:ry8VZ8pXfl9Bd80XVUccH8e

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4253

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
a8570a5f79657eee1ce2fb3823a5a162

SHA1
2d612cfd1aaac8dbc20c0ff71198ba9c52160192

SHA256
7b30cc2f784e0bcc215618c9c4157edecdd60a98a0451ad406ced69a85addcc5

SHA512
0809c0694d9eb96350ecb5ea7973e3eca7387114af145da30828f8253eb8d60390ae27fc9755d232ff9738ff9e35f262ed52c43118cd735ebecee474d1a5b70a

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2593b7f454604b5d6205a6ccae2f167a

SHA1
2382980ce36f9f7946741d0bf77843bf2aa8c62c

SHA256
560fe617856934faab434e869939b468e3979940b5f0b4fa9dead14633f2fedd

SHA512
9c4a0d10ee212f73c18ad1d2e64e5e13bc54a128ef4b25aa007111c6dcf4f59dfd33d6170ea181c10a13f399a1260a2230f14ecf241d37259651374e7953eb67

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
39a70803fc410129daffbd5331413871

SHA1
acd4210ea3c166fe5223d3faca98975d3ea2b472

SHA256
5408c338f829c521b92886c4439ddd7e14f633b223b6125a56ee8b8720bc2f8f

SHA512
6c2debc1017ef84286a9124690e743d8dbf895bb3a51b422b25f2549ac4e86986c5229f65b8b2f50468bb21a678f22aad619537d5e55e20dcfc1556899a84ffb

Download Submit