6ea84c85cdc8dfa79368d52b20bc0c2c552d3ff730b7499d3de842a2fd4a97f2

General

Target

6ea84c85cdc8dfa79368d52b20bc0c2c552d3ff730b7499d3de842a2fd4a97f2.apk
Size

3.5MB
MD5

775578303ba2794d42558791842d550b
SHA1

5ef6f5dd7c9a9a1897aa261284302a58e4840079
SHA256

6ea84c85cdc8dfa79368d52b20bc0c2c552d3ff730b7499d3de842a2fd4a97f2
SHA512

7c56bc98a93a5bbd81803626b34ec9e51f9bc361993a05e1b705d38a93bf5bdedf352e00e48e44eb292702de0ab12bc3d46161fac9fbd123de8f075a79f01629
SSDEEP

98304:cf5LKdJz4F9pI54UGS1sVYNQIAKLWrEi3M:W5LKfz4PpOmSeVYiIAkWrV3M

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 6 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo
File opened for read	/proc/cpuinfo	/system/bin/cat /proc/cpuinfo

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4270
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4331

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4371
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4433

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4461
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4489

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4517
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4545

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4584
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4612

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4695
- /system/bin/cat /proc/cpuinfo
  2⤵
  - Checks CPU information
  PID:4723

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
4d4dfb3fb428e149645b82ff2fea59d3

SHA1
3a884bbd89a8e6b596d131476a3a5dae7785a158

SHA256
99114c5f043a1dd3fa1d00f489d41b9b82560c39f426b244ccd5d997167358f5

SHA512
9f4358667d9d40e571ccf00c5f2ac3d9905431d4f273cd3e8962c00700ad2986f75aec0999005ab3a53bcaa51ec5834668acfa8c4dc4efd90abaf9acdd570012

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
a208da5a170fedf33d0d6e93401ef8cf

SHA1
63d936c7c5c554460ffb5b454ba1d82dd9a59d1e

SHA256
489bc1099a36a8eb695b8c805005288fdfd2fbd322b897dd8c32fed4e8fb0df1

SHA512
e647d9b7e5b8ac638cd5e7b9ed919ace9517492d3abd9f5accbf54cdd436ccf45d42a8e20b3ddc4841f96a8dd776c02a5cf44e959f75afadcb8ad25b5a86c8b5

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
d85ddce79efbe39c2e1d32e08c7b919f

SHA1
ea87d3d366590215f9ae512649c1aae1ec9e7b93

SHA256
8da1969dd793c5e2b2f9c920d17d6540ac7380a295361412a11d4eae2324a26e

SHA512
6e4bdde3cd30b40b600ed3f599bc9dbeaee2ff6e92c02e44d1db2fd15f6c4b004a44e3cd176855eb787e90c10b066d501233ffeec4197ab2fce0c1689760ed17

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads