faca6f37c60a21804ad72938553da070f7641bad0a29084da9babfa22e495be6

General

Target

faca6f37c60a21804ad72938553da070f7641bad0a29084da9babfa22e495be6.apk
Size

3.7MB
MD5

0fde05a59f67cf457fb60b55793e8cb6
SHA1

de648669eb42fc30c300615de65922fd1a01a166
SHA256

faca6f37c60a21804ad72938553da070f7641bad0a29084da9babfa22e495be6
SHA512

7d1e643febdf2a45fefa78f5be947834a637883a1adad3b8cbe5bf89c1fd6acd5d99b1b67df89799d03a44961cc6adb16ba298a9c4d896aaa81a7edada098047
SSDEEP

98304:dz1y8VQyJ8pVZflV3BdXs0DDVaLccrz8e:ry8VZ8pXfl9Bd80XVUccH8e

Score

7^/10

collection credential_access discovery evasion

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 6 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4255
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4284

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:4327
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4391

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:4421
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4450

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4480
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4512

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4564
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4596

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4703
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4733

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c4626f3013cf34642f36ba87d3e1e8b9

SHA1
a2ffbb4738a2ecd847f91a0dd7d62d4a26f54151

SHA256
3e81434001e9699398a577eeeb2ca8cf7cef1f73125b8107c88ae35be278be45

SHA512
9616afa0245c4130787233255fc525361dcf9bc75ec156d683cf3441a05cce9c86c13e701be2fba834bbaa3c62eefca1bd6a7ee51b14e393763aad6c4af5efea

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
28KB

MD5
a403fc1d375397181e11058ecca92554

SHA1
64f7c5bf09aca9c06bbefbeadbb6b8791c9f24fc

SHA256
7b60cc0e427860416a762cec2419b5f1fa022cf01a38cc27dc8c6f1ac99aee72

SHA512
37f041946a92e77a76c351fbd83b143d0e971cf8d120d943213adde9179aff4612f61d799c0baac4026c1cee0738ca47e094fb0e22892d281d75787237a23ad7

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
8d99d8742dc15fc5d373ff11ac88830c

SHA1
a072074a3dc7b68cb2510003250cf44157471a0d

SHA256
894d8dab05746c61978ca880cf7f974888bb33a92e081cee9e7e30b189b566df

SHA512
4818be23d3e0283d4a512c1e89128173492dad7fc7a6004450829f11d2187d2262389b921601c8d7f395fb89eb9f533ad934ce85bbd54c9ec42c985c9e4240bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads