Analysis
-
max time kernel
72s -
max time network
123s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
13-01-2025 18:19
General
-
Target
f5050a664ed6db7c4ef18bcb52d32e65aaacde3e65899f09df39c45c7bcd88b1.apk
-
Size
3.6MB
-
MD5
b71eea4c65cf81d71a7a437ee480e345
-
SHA1
888b1e2f1aae6388ca7a2d47a79ad1f4fe07fc2a
-
SHA256
f5050a664ed6db7c4ef18bcb52d32e65aaacde3e65899f09df39c45c7bcd88b1
-
SHA512
b93dcb9db1b3ba81717ea997d4316abc4160bba3ac62038a84c3f36d5f290b2eeb0c14d33c6566dfd25c7cbfb48fbf8d2e7c7075008dd3333cea02acfefa2c45
-
SSDEEP
98304:ic1y8VpuDWck8pZHfVv2aucRDNgLPFRQXcYyl:Ny8VpuCckOvhBePFRrYyl
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 12 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries information about running processes on the device 1 TTPs 6 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Acquires the wake lock 2 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Reads information about phone network operator. 1 TTPs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 6 IoCs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Requests disabling of battery optimizations (often used to enable hiding in the background).
-
/system/bin/cat /proc/cpuinfo2⤵
- Checks CPU information
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Foreground Persistence
1Hide Artifacts
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Discovery
Process Discovery
1System Information Discovery
1System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50c73864e26319c73d3daee7acd96560f
SHA1d88a2bf5d74ab5fff53cfdf51f06f2b4ce6e3382
SHA25649030e259b0d6051c4a8e30cb7b16eebcf45577d45853d842c53bd388c315175
SHA51291c5d1c1d6bcb9677962581354eb3b50399a235f49475a74c427d2cecc20f50c068cd5233a554e1d20a2656281dcf926505448449361f63031a35c38c298ab80
-
Filesize
108KB
MD5970f4c3678f5ed4b8f4503549eb89075
SHA1402eb8877468dadb68ffc346dc7baa6f19a8cd96
SHA256bff9cc00b511d488541db8a7d3178fe7ec6769fa4cd6f1be8b21695d72187faf
SHA5125b380f6efabe0a6f9c4c8f6e5c78bb05b54952f30a9106c2767140847b1c5011263e39983aa73c28523d203ec5628009e6522cb3276c06b50f8d9ae02e2fea76
-
Filesize
28KB
MD5aaed0df656c2de4f2332e14cca900d8c
SHA1262bfbb9caa220545c2f840c2d54fcfa87d6b632
SHA256b11ed97bc2094518e04c70d9321d00adee9e33e6588cb683af529fd97290b766
SHA512727f2ef3f7e5ba4cee8801aad86a70a594a107221a0dbf289ba3e8d4c2c33eefaf3c98c4a8d05c9a9c6c5890ebd4ae08ebf72f6bf74ba70bbdee43e137d27814