Analysis
-
max time kernel
149s -
max time network
151s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system -
submitted
28/02/2025, 18:56
Behavioral task
behavioral1
Sample
83bbbbfd9e2b34c08b6e2d38ec029ccd63b459006e528bb39d196f9681ff310b.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
83bbbbfd9e2b34c08b6e2d38ec029ccd63b459006e528bb39d196f9681ff310b.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
83bbbbfd9e2b34c08b6e2d38ec029ccd63b459006e528bb39d196f9681ff310b.apk
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral4
Sample
base.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
base.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral6
Sample
base.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
base.apk
-
Size
3.5MB
-
MD5
adc5d16499c92152a1b96f97edecf63d
-
SHA1
35f9c75df79fbd36e89e65e99463bccc62988426
-
SHA256
8e5051ee23cb01c25f0adcee6475f4fbd4cff15edaf08c7a81676ced4bfbbd39
-
SHA512
fd57f7d4e43bcb38469980b8b23a1e38122f3634e461cc2b50a187cd7e5e3560e55fa8c2e7f74625ca9bb59730121889b439cc03206126c9334164c5cf36e80b
-
SSDEEP
49152:pgWoVs7LxArmZtZqKD0LSNGUNog3SFI80X6Qpd2x6x8MbsCnJMzvvS9jz0o/nq:I67LxA+DqKD1G2FxNAx6x8vrLYjQt
Malware Config
Signatures
-
Checks known Qemu pipes. 1 TTPs 12 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/qemu_pipe com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/socket/qemud com.example.mysoul /dev/qemu_pipe com.example.mysoul /dev/socket/qemud com.example.mysoul -
Queries information about running processes on the device 1 TTPs 6 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul Framework service call android.app.IActivityManager.getRunningAppProcesses com.example.mysoul -
Acquires the wake lock 2 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.example.mysoul Framework service call android.os.IPowerManager.acquireWakeLock com.example.mysoul -
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground com.example.mysoul Framework service call android.app.IActivityManager.setServiceForeground com.example.mysoul -
Reads information about phone network operator. 1 TTPs
Processes
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5138
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5250
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5319
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:5372
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5435
-
com.example.mysoul1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
PID:5487
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5d16c66acf9e38bd44239e0da730a9a2a
SHA1f6d26c19e5d01be8af51cd550577ceb85bb7bf6e
SHA25684b1791a6021b46ea98fc8f04f6bca563093630d0e1b379a10365c1ce5e511bf
SHA5122d6b69768f63b0a49ad317d0c2706bf014c62494fb9ee16661a6d520141011f12373ed1943ec1248ca2163cf30de74834b282065cc4b9a2fbc81052713ad5b7d
-
Filesize
108KB
MD5e873940d51aee6ed94a907906a9b733c
SHA199be697a471ce652bcc8c6ef2011833a5ae3e1c8
SHA2565a10a6ddee7cb7c03db036b7ec15bbbfeb26f28946fcb87cf0dae1718b56281f
SHA51279540f227888bce77c4e851e33b1ce6e62bc857dad58d42eddc904274d600636d7168330c74addcf38eeb127b07cdeb9b0daf39e758187647d207daf98ab55a0
-
Filesize
32KB
MD5c3d53319eb25169eed4227f2de1a4e18
SHA1da2af625122e6f7736f11514281e9d6f0bccbd93
SHA256e27df94eb0e7167e7c7a99be104a27196ff2549a0a9c4cf322eb61b9206aa40c
SHA5123a384d6d79309fac3f84bba0d2b0f253611bfc0836f342a6dc35bc106b7f525b1555754409593c87526de3006797ae520134f9f9f38bb3c34c21f5f998ff18b3