Resubmissions

28/02/2025, 19:01

250228-xn824avqs3 10

28/02/2025, 18:56

250228-xls8vsvpv9 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    28/02/2025, 18:56

General

  • Target

    base.apk

  • Size

    3.5MB

  • MD5

    adc5d16499c92152a1b96f97edecf63d

  • SHA1

    35f9c75df79fbd36e89e65e99463bccc62988426

  • SHA256

    8e5051ee23cb01c25f0adcee6475f4fbd4cff15edaf08c7a81676ced4bfbbd39

  • SHA512

    fd57f7d4e43bcb38469980b8b23a1e38122f3634e461cc2b50a187cd7e5e3560e55fa8c2e7f74625ca9bb59730121889b439cc03206126c9334164c5cf36e80b

  • SSDEEP

    49152:pgWoVs7LxArmZtZqKD0LSNGUNog3SFI80X6Qpd2x6x8MbsCnJMzvvS9jz0o/nq:I67LxA+DqKD1G2FxNAx6x8vrLYjQt

Malware Config

Signatures

  • Checks known Qemu pipes. 1 TTPs 12 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Queries information about running processes on the device 1 TTPs 6 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 2 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Reads information about phone network operator. 1 TTPs

Processes

  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    PID:5138
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    PID:5250
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    PID:5319
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    PID:5372
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    PID:5435
  • com.example.mysoul
    1⤵
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    PID:5487

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    d16c66acf9e38bd44239e0da730a9a2a

    SHA1

    f6d26c19e5d01be8af51cd550577ceb85bb7bf6e

    SHA256

    84b1791a6021b46ea98fc8f04f6bca563093630d0e1b379a10365c1ce5e511bf

    SHA512

    2d6b69768f63b0a49ad317d0c2706bf014c62494fb9ee16661a6d520141011f12373ed1943ec1248ca2163cf30de74834b282065cc4b9a2fbc81052713ad5b7d

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

    Filesize

    108KB

    MD5

    e873940d51aee6ed94a907906a9b733c

    SHA1

    99be697a471ce652bcc8c6ef2011833a5ae3e1c8

    SHA256

    5a10a6ddee7cb7c03db036b7ec15bbbfeb26f28946fcb87cf0dae1718b56281f

    SHA512

    79540f227888bce77c4e851e33b1ce6e62bc857dad58d42eddc904274d600636d7168330c74addcf38eeb127b07cdeb9b0daf39e758187647d207daf98ab55a0

  • /data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

    Filesize

    32KB

    MD5

    c3d53319eb25169eed4227f2de1a4e18

    SHA1

    da2af625122e6f7736f11514281e9d6f0bccbd93

    SHA256

    e27df94eb0e7167e7c7a99be104a27196ff2549a0a9c4cf322eb61b9206aa40c

    SHA512

    3a384d6d79309fac3f84bba0d2b0f253611bfc0836f342a6dc35bc106b7f525b1555754409593c87526de3006797ae520134f9f9f38bb3c34c21f5f998ff18b3