6703fb236a17f4aa130022302fcc9c8833e4db4ba279e0eae7834c084250b38d

Analysis

max time kernel
2s
max time network
589s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
01-05-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

magismobile_SHARE.apk
Size

28.2MB
MD5

92e8627b59e285b614486c93d0c5bbb0
SHA1

b3d9d40ca964228c056a4c4c1956e9c5d24ac156
SHA256

6703fb236a17f4aa130022302fcc9c8833e4db4ba279e0eae7834c084250b38d
SHA512

56661e2bd45c760d5a9df38f701ee05db69f8a09ace1630e77a35bb63caba9690565534548495b2ed7a22bb1d95f6a087a80ffd87abad6207288304de2fe00b5
SSDEEP

786432:sJZSPOVLQR/mRL581uD/V9CMOy9l5bhILYgImByh8D:sJfVL1581E/LCKDhJmByS

Score

7^/10

evasion

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 5 IoCs

evasion

System Checks

T1633.001

Processes:

com.msandroid.mobile

description	ioc	process
Accessed system property	key: ro.bootmode	com.msandroid.mobile
Accessed system property	key: ro.hardware	com.msandroid.mobile
Accessed system property	key: ro.product.device	com.msandroid.mobile
Accessed system property	key: ro.product.model	com.msandroid.mobile
Accessed system property	key: ro.bootloader	com.msandroid.mobile

Checks Qemu related system properties. 1 TTPs 7 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

evasion

System Checks

T1633.001

Processes:

com.msandroid.mobile

description	ioc	process
Accessed system property	key: qemu.sf.fake_camera	com.msandroid.mobile
Accessed system property	key: ro.kernel.android.qemud	com.msandroid.mobile
Accessed system property	key: ro.kernel.qemu.gles	com.msandroid.mobile
Accessed system property	key: ro.kernel.qemu	com.msandroid.mobile
Accessed system property	key: init.svc.qemud	com.msandroid.mobile
Accessed system property	key: init.svc.qemu-props	com.msandroid.mobile
Accessed system property	key: qemu.hw.mainkeys	com.msandroid.mobile

Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
evasion

System Checks
T1633.001

Processes:

com.msandroid.mobile

ioc process

/dev/qemu_pipe com.msandroid.mobile
/dev/socket/qemud com.msandroid.mobile
Checks the presence of a debugger
evasion

ioc	process
/dev/qemu_pipe	com.msandroid.mobile
/dev/socket/qemud	com.msandroid.mobile

com.msandroid.mobile
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Checks known Qemu pipes.
PID:4473

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads