83e96b6886db8b9c0f60d45fa0c9a3e58134f3358313bc0e4e42fb2e90080627

Analysis

max time kernel
31s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
01/04/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e96b6886db8b9c0f60d45fa0c9a3e58134f3358313bc0e4e42fb2e90080627.apk
Size

3.5MB
MD5

a80cffbf5d86a49eb4c653f04eb405b6
SHA1

60047b65f4299fd48276cc2b47da7f40b39319f5
SHA256

83e96b6886db8b9c0f60d45fa0c9a3e58134f3358313bc0e4e42fb2e90080627
SHA512

8d2635fab9b5110a824d757c2f8e94885d0de0f5eebdaa861770b783b2fe6c6a1631bd7608e9008e704692403d3d0713fe734ac031039a94796c191ff27b25f2
SSDEEP

98304:51y80gJAa+ksft5gZBBlEiElptVLZZDyv:3y80mAa+kMoBlEjlpt1ZZuv

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:4341

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cbf343fa89e60fe52c925a171f7e2dfa

SHA1
1658b67212312cae84adf9ff1e0a3397e49c2217

SHA256
a47fac061b5c1b41fe37ca5fb5069d8f708b0c241d10dfa454361f59a66efb37

SHA512
5663fb888f5d3a02d2afc63ad2b5a4d97e97a671531829f7b63b0c0680c3867756d7fb8c91f39f1a4775362099bb8124d7c0746f0e2a86807e6312e51b2d5d00

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
0beeb4eed135ba4202233c7622948aca

SHA1
85aa485dd75064577d5e9cfa8d63ffc539372ae3

SHA256
6552752262a161c61c393c160a16a3ce0ad614a10f1d9df66c4f4bfc35d66ee0

SHA512
feb6613848f376461274ac01ad20c8ece93ca3f93c8f2aea770101d8678204539063f51c6966cdf6a3d1f52a2649d8d92aff2653f475a4e4cc832203117e00dd

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
4d3e27dc58a7c0282f81dd7b7a14cc3c

SHA1
cf59b7e7fbb27d52b9ee33032ba0cc708417052e

SHA256
7d4030f314854e0e4ea3eddf99fa1d05a1eddb64b27341c54049a8a1df55efc6

SHA512
9c3deffefb482602b64a28cd362b952496edbf2a44e491baca1a6f4fdf0928f34f9f7ddc8c7dbb30be9251c729ca862a0a25f1847e89d1963c7148b98d64ad3c

Download Submit