52139d9957e9ecc9d2103961c9439f586c95e6d76493dcb86c80fe27d7e63b28

General

Target

52139d9957e9ecc9d2103961c9439f586c95e6d76493dcb86c80fe27d7e63b28.apk
Size

3.5MB
MD5

bff08912ebe878e1316cb9c325aafeca
SHA1

6bd081db16eeadbaf8a2c8c2e287f877d46f505c
SHA256

52139d9957e9ecc9d2103961c9439f586c95e6d76493dcb86c80fe27d7e63b28
SHA512

50c088af4b0063095c5667db4f2d1c12f88ed14c316e968b3713ddbdd44c15131923fc80f09201e8961872a7c443f4349b4d0b9a17dcd099b9f9463a12eb76ce
SSDEEP

98304:k1y80ZJA3w9bR+OwHE/dPrPv5eCVLSZDyR:Ay80rA3w9XW2RpeC1SZuR

Score

7^/10

collection credential_access defense_evasion discovery

Malware Config

Signatures

Checks known Qemu pipes. 1 TTPs 12 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

defense_evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/socket/qemud	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul
/dev/qemu_pipe	com.example.mysoul

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.mysoul

Queries information about running processes on the device 1 TTPs 6 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.example.mysoul

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5162

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Makes use of the framework's Accessibility service
- Queries information about running processes on the device
PID:5276

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5348

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5402

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5462

com.example.mysoul
1⤵
- Checks known Qemu pipes.
- Queries information about running processes on the device
PID:5532

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

1

T1417.001

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Input Capture

2

T1417

GUI Input Capture

1

T1417.002

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.mysoul/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ef1b1973648fa40af623c9f26077ff25

SHA1
48d07900faeccac530ae97c09ff8b70ab865525d

SHA256
97f1b160ae3ce5ad5dfb986d932a40f18f8306b6893436e9c3cc0baa003570bb

SHA512
1063ed2de116565284635626a7ad28f31d0857d8768d9fea35187958f9c8387826c38a9e7b07d5369b95ab20ab386f0f9eb6be44d58bfd920ef818fae83c9ac2

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ffd93dd435004fcad0861d9bb9bd948f

SHA1
d2e3c48101d642da45eee2d62b5d48560c90d2b1

SHA256
0eb332b665e8e6f6194224725a6ff603271957d03bc33e8297435263462c0523

SHA512
ed363ad080c855ddcb490775e5f6f132016b5b4d1cee007f4e70eae019f89a88724c2b3855d6ea4192a997ff293e7275a5f7770117daf1e8027862e6306c8b88

Download Submit
/data/data/com.example.mysoul/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
b83e296a75f35a1df2ae75f774543dbc

SHA1
c1f409bcfb6d77ed3ad905aceffbabe3ec845765

SHA256
10c5e0e5944e482bc706a0db199ec8c3dcbf94a34091c831ee1535019d81ee7e

SHA512
f4b900550cc63cf0ec8b3115c8d7250952ca9d9d98f0d4ad71f6078364032b3de600e40529e7e7ee36864d138854d1d52fb13c86e4be03bf95eca547ce819ea2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads