Analysis

  • max time kernel
    169s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 09:06

General

  • Target

    mgsProMob_P500_V1_debug.apk

  • Size

    40.7MB

  • MD5

    c0e1a0b126f2e0a869828b9dad9952a7

  • SHA1

    04ac4e88af4a29154d78d038ec65f0ef661b2d64

  • SHA256

    34cf4c116d03231715b4a5071acc361e4aa182e2f147f2b3c249a6b0099f2a66

  • SHA512

    a76c368ad8c621711f1d7fc11970ff0498fbde9183481bc779cd7b1786a16c41946e697e2e5b110cd486fe7d0d0caba8c3a332d919357479b47e089896a783c0

  • SSDEEP

    786432:lLdyxk3/rQF++5jg+qpKIej6Ikw+bRqJajwqjwfR+Bkh/+bRqJiCeMRrYRAEzRXq:lLwxWck/Xf4CZNqJijgIah2NqJiCeMis

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks Android system properties for emulator presence. 1 TTPs 3 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.android.mgsmob
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4263

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.android.mgsmob/databases/BBDatabase.db-journal
    Filesize

    512B

    MD5

    c485c83583fad3782ebdeafa8124aa30

    SHA1

    af481ab3f60aa36472d4d197674ab37d79275a98

    SHA256

    625feb7152900e4a1d3f9808636b9817af3c35ff6cd488020867305dbddabe87

    SHA512

    0812ffd5caee38b4080b39094cd199b55152e7ef32afcbb52cf70cedf8a6880858f9e1f42a5029ea49379da13aec0c42e418cfb941839256e6fcb6c46097ea7f

  • /data/data/com.android.mgsmob/databases/BBDatabase.db-wal
    Filesize

    32KB

    MD5

    9a8240c6eb20f1cf0d2fca3b5cb32c09

    SHA1

    3868122e67558050492e78e68b83445bbd26e667

    SHA256

    926bacefe1252146a96d2ffeef0d821b795ccdbf8c5107924d02bf7dbb90b59d

    SHA512

    bf659fc371ae5fe325ee3f9534f3add696393ae60fd1d35fc0308edfff6c54c10b08a7db609283e00e745208dd3e0c2e8de147a7fa42560baaaa7716e8281420

  • /data/data/com.android.mgsmob/databases/addb-journal
    Filesize

    512B

    MD5

    18fd4a8d9a6b7273cb0b71462de0f7c5

    SHA1

    5cda14babb3190b962b7fe0f02afd938781b13ba

    SHA256

    34bfc40d27eede7086e8d88c472194401c5029f2a6d618c1c5730c20f4008329

    SHA512

    6b55c00d7aa62388e0dbf9e5a5adced0cdfc314e3652e114d00f23fcf244bd80d58c94d9b5385e8528a4c441cee63604ef368606e62896cc9b6ef418a3719be8

  • /data/data/com.android.mgsmob/databases/addb-wal
    Filesize

    32KB

    MD5

    32089d98bc38f93b1ad33058a459de25

    SHA1

    b61c1a1fec1592674a461e3b36e6f459c6d15904

    SHA256

    cbbd38cbd274ab685638c8fffa570bc78934440b81430c78578a89eb0a35f34d

    SHA512

    a3ddedc3353a8dea8de6864877c27f0afe4e261dc412cb118b40f636c349152c4b78477d5c65ef714db439212933d5692030b6a946abb624cec08025d664c5d3

  • /data/data/com.android.mgsmob/databases/com.google.android.datatransport.events
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.android.mgsmob/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    18b1d16d22d5654435c52c98cc0e1eff

    SHA1

    1d9fa6b6e8dde374e8c02067b9298d4a0fdde7d3

    SHA256

    f1b41d409b17d586b799e4f3232cbbf0bbec8ae994c1376a9bf2428473870623

    SHA512

    1959780a2e9590788f6d57e08e38903f9d1f357d31a4b630fcb5f1f5679cb3ee0c3e1051ca5b10972ef1859e69bc5ca37e3ac0aa27f1c8e5a8a78c68c461fac5

  • /data/data/com.android.mgsmob/databases/com.google.android.datatransport.events-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.android.mgsmob/databases/com.google.android.datatransport.events-wal
    Filesize

    52KB

    MD5

    c19170a688356b89e62620852a525704

    SHA1

    759026419474f76259a6f4167469ccc8f7cf4f6f

    SHA256

    f5051b59fe33a083738fef8e9341cecc223a8f04d2d5dcf2ac924b6459ad52f9

    SHA512

    48808e2396cf83a97fabd63b5fca24ab3946ad44745d35908da1bf89b20ddd9b47fb2a0cb689a4629fd7620b08e2e0325d85f5c7a68be33b6290a6c5c69e6278

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    7237409e0640cfab7bdbd429bf821a3b

    SHA1

    4c3da934842f8d4835dfe2a9c275a300e5123309

    SHA256

    5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

    SHA512

    c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    40c3e5ea0e393fcc410dc3520e754612

    SHA1

    43237d90736ad597f505f369e753d2c0a6ba7d5f

    SHA256

    120a00b4ce2dde5779d328e955fa2f193e90f222aca54b5eee7ea4c1a5c8ca6d

    SHA512

    d0bad3063eced8f06d12e9e851fbf0171e2fe2d4511148208bcb2bb7d816bfb05743952d5e96110bbca1e3a653d7772cff13d7350632ed4d57c915c4b5625969

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    1cf9263db2d9fe13ca21ef2aad858e39

    SHA1

    8021fd109c12feb07f43b3f2e6f2ec4c6acbf27e

    SHA256

    570ffd7ec79736e4058ee8d43be75899a1688956f1b1cba04e51323ebe0ad28c

    SHA512

    894a63f31027abc53bd6b7d38d1ae9a19cf9ca909dd07158b1546e79a9bfe5061fb97e1d46720160d4ffde35918bde451f55c00c247ca829c4ca5f4a99b02cdb

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    24505fe0515865c2a257203288b6d7f2

    SHA1

    817a113ef54a6ac992ff93dfae6a5ac957563ea2

    SHA256

    546a212f0916c44b4f7bdd65114d86f24a5b5993d421cc4880a22ceea90d3319

    SHA512

    bf9b7add4ca5a951afec7a4240ca5f16da2d87936bfe20da4b45afebccf23a5e3991545a420f3377b742a73d578c310c43d32e72752075f8c78eeb0f700fcd6d

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    7023283d63b86e337e7cb0c6e0d15ff0

    SHA1

    7917bd3e1826a32f8251589d4dac6912a0f85083

    SHA256

    a951ca90c2215eea1a653cddd1aa0b273728cf7e66109b755eb3071dd596f1a1

    SHA512

    f5669e4269d242d6053b03127ba931d7306cd241145e20cbb27d0a2b463b976a602c15f843de2d5fa8c798111cc855940fef72cdc419fb4245ceb871727c1753

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    d0efc47ccc1b0d30b0530f1fb696baf0

    SHA1

    fe66d16beea26f9a485cb57b475dc88b6de0bd26

    SHA256

    4e4c27ff6098c9d35fafb87b383852b32f9542aab8ec6972242685a3ea42db18

    SHA512

    ea75e0d982c38d19da884da576c37c171056a1c23c0676800a94fb4708b7efc06a804f7b1223054287cc341bc575eb9b284788754bf53addaa4551ba40ad9d5a

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-journal
    Filesize

    512B

    MD5

    6ad0d36e03c221f637e32947d5e00bc7

    SHA1

    ee3c87d50992e5d37610db53471fd90a8aeb3a75

    SHA256

    bc207b2878c6b9b4a2cc40dea090815570482ebbd3e13ef4fed21e41315d7597

    SHA512

    982de95c4033127313121924bfc7a7533278a33237de199fdee799d6e516fc3a65bb8a086957da20ed09df200d00cd57aeee33bab09f727876c00c8c7a905e18

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-wal
    Filesize

    36KB

    MD5

    14f417a4f10cf4683d087ac937200e74

    SHA1

    e6ce41efffe76bd57d4648652b7f4a1809e83547

    SHA256

    b00637d2554a94cbc81c44a1122605d5a988941fd527c96f4d7852695068e858

    SHA512

    2bbcd5607aaefaeb0afdbb176dd3c9f805f98ab2c07c298a071751974a43ff2478705f0f9c69233e70587feb8b9a7f97cec816defa4e7c890cb92bbac1d89ed5

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-wal
    Filesize

    4KB

    MD5

    b8d792474730c15d996ad3bf69b7f468

    SHA1

    c34ee496f81ad317aa21e3190240ef7c4cac781c

    SHA256

    cd5111c53c785ef0a9e91682905272a204262e8975bd8e6c27240d07251229cd

    SHA512

    006a4d8f7332601c9402dbdf84418d4200cc0dd966b09359fe8896f3b70db7beced00eb5fd45052c1b9908ab01c9b60ef6666ab303a1581f2c1eea47b9f005d8

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-wal
    Filesize

    4KB

    MD5

    0bd399089c955fa9a3d41a962664f798

    SHA1

    8907ad1758eeaa51e54668862383bf059aeabb5a

    SHA256

    15c0bfa3ce3e23d240bb317c6f784256746ada635b578546af9512422d5c9d2f

    SHA512

    171e588b2d8521fc1ef291eb342e7c6d96dd077a4ac6be8770c458125fb7b544fea74767d43822d9fb2375e84f3d578e5cf711030fef30e53028c1869358b279

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-wal
    Filesize

    4KB

    MD5

    0fb571221ed6865c9c0e7ebf6da063b6

    SHA1

    0bc7c3a6c8fac2c308a53017073d20a4843845fb

    SHA256

    895b92bc00eb17b8e213fc4ee3b78f3e0a5f0d6aea489a495d897e5274150739

    SHA512

    8ad2756773d6552593355cc518fc9cf84adc420067130b70d3a93390b5951334ab5a315bb6be3f5f9843544b756804333d42eca29b2a338dbd7b29b3e2bb4d2f

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-wal
    Filesize

    4KB

    MD5

    2f408229fd87be43817b0e12138c04a3

    SHA1

    0d5f4905d8f3a22eeb1dfacb4ca3b14e1f239e74

    SHA256

    10fa342a022015d8fd65daa0deaa417390a5c22f5a3acd4813602a1edb5331c4

    SHA512

    8fa0f717634a8b7e84d2f8677097802aa7dbbc04686f2edf33c81b4d2f1eb8e807c7e9f02f8bbfb2f0b80066550efe1a1b50b0374cd95731ac31730b475ecaaf

  • /data/data/com.android.mgsmob/databases/google_app_measurement_local.db-wal
    Filesize

    4KB

    MD5

    83740b8c0fbc38affdbf8454850e274c

    SHA1

    c4d4f997f3b874775e303b7a32e63acff04843c1

    SHA256

    255b42915de68553384aef295142a6fd32cf980783d135f188fd2b49454284db

    SHA512

    e6226204a77ad888409f195cb1d892230ea7a65b8267f090fcc8e001d283dfabadcf499ce77f40a7321253a9d4e9f24f599a89b61b1168a79de7505f2f7aa62f

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/app.json
    Filesize

    179B

    MD5

    c1d41fd0beae346a3684d90ea0b5b917

    SHA1

    61b05a044885a08c8397e20c45362a5fa2c2ff73

    SHA256

    d035a1d01bb7553b73e9b586c19748e1310736128a6278056c071006f75a4641

    SHA512

    e12ff653f4faec3ee1a1f6bd1924c40ab76192030eca115ad7a13701e54bb681573262af682da44efde4cd0d1fb677a49dd1f53b10d4a6ee8f2635afb0ea0518

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/device.json
    Filesize

    193B

    MD5

    488b1489ac4d3b89d10d3f873727ee41

    SHA1

    f65273aa79f9d0205c11dcaaf257457d85a68ed9

    SHA256

    25189431ccb3f67616108f0cafbb993d864566d63fc9c19b3e1b86f863a7c54e

    SHA512

    7493d142c751abfea8b4088f8cb72491ff48864cc2ab189d63a38a57ad5babb475c44165775834620a877aec7781f2247f59bd3427c27d2e805797de25522b59

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/os.json
    Filesize

    54B

    MD5

    93023624eb8dff5c20050da136aaae0a

    SHA1

    acfd1ffed752c28fb135ba83c0c6345ddf2f6995

    SHA256

    968bcd7c4f1abed89a09cc0e6dadd238a81e8655e64196b39a86be49ceecd39c

    SHA512

    bb25dfa144d3f0e17203936c503c5fedec5f9ca710e177f99e273010ba4a682199d4bda5684151d65f3cb1549f4611b3a645ce39646d3db9a1b2c17d6b160579

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/session.json
    Filesize

    127B

    MD5

    10fbfbb5c5b57df841e71f9c597b2246

    SHA1

    ae6acab786d1fe0146e0de4f306a0a70088e9659

    SHA256

    788d188fba89c2cffb16ee50faa7f541a075d9974812638f4defa333b1e53714

    SHA512

    c6fb667d30e2db4837a044aff1f9b72fa584fcd1a4fadd4c962cad30d5470ae5e0fbdc59597c906dc0dbeeafc47c8b6bce566a0c00faf23388c10ddff4e09cf9

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json
    Filesize

    716B

    MD5

    5a287f32d006d909e321267314728012

    SHA1

    0319a33d3ef292ccf753d6ca545e5b928e355d14

    SHA256

    96447574eb99cca7c92cafe73ae026cba33b1d8d6556f491576193063cdd1210

    SHA512

    2e1569b8761b704e0a17a38922cf0276d51d89f2db9f39b532cfa2f7240ef8a6239b00f4942114de8fad33f68d8ea225b6e19a450359b03bd73779c8af65dda2

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DB5C7020D000110A7BE8C4DD20F9D.temp
    Filesize

    441B

    MD5

    72aef8bd2745ab0a4f51687d7477dcfe

    SHA1

    9c6d9ad4698a52ac0ff995ff8a0c04d8b22621f5

    SHA256

    88134dad414c1626ade6b7643d9f1aaab337170b7cdec53326bf74bc3d07e18e

    SHA512

    49006527d9041f2dc291eb580e32ab37a149b45956d41b5a235c5574f38d4cd97316afc954fd354f02e0acc0287dfa38854e76e68b8e9279cec070d49b86cd8f

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DB5C7020D000110A7BE8C4DD20F9D.temp.tmp
    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/report-persistence/sessions/664DB5C7020D000110A7BE8C4DD20F9D/report
    Filesize

    751B

    MD5

    1e19aade99e8f6dc78854965b66018d9

    SHA1

    6e18e0d9ee6053016d7066c08c28ea032380eaa8

    SHA256

    072c372d64f46078ff774438f7d43aff3b6c0dad1c8e6334e732f19881da0d59

    SHA512

    9159f4eceff4256aef00fed8060117ceec3122b3e10aec17c096e206acfb97bdf198e11ac529bbec0642b24c0b8e2df1b4c38b6cbd081f0721ffa02dc364b757

  • /data/data/com.android.mgsmob/files/PersistedInstallation7854404127048426016tmp
    Filesize

    569B

    MD5

    3bba75aa821e25cd27d7ecee77578675

    SHA1

    2cb2b5eee2edf96a4438c721b872525e8c49fa9c

    SHA256

    26645eb9ce603727688e5a1f8b3009b8be0eea7196aaf273b3f1d6af6942f65d

    SHA512

    baf4ecd228d7e1989c363df1fad699fc112d017a74250608c706ac0ea0b5665d8ed18e58ec2d3fb631a1dab25ba2176edca11c1553c98525f718fea0537deffe

  • /data/data/com.android.mgsmob/files/PersistedInstallation8975163905723324372tmp
    Filesize

    90B

    MD5

    374b5cc1e89e636ce47921a2ed84e2ab

    SHA1

    3c49cbfd65de491236440c6101cf350e9588e130

    SHA256

    53e1659acbb0252951674c352aa0c3f5ec02a3611b495e5943509ee1b76bd59f

    SHA512

    041eb6b064d440f673e2231dca7cf27222fb17597ce7abcf2b6caef8d2245b46b50951a3e812300d945ad2ffc5c8b678a326c6b80f62bcbfe6fa38ed3798bb4e

  • /data/data/com.android.mgsmob/files/cacert.pem
    Filesize

    221KB

    MD5

    be2b0736ea029fff398559fa7df4e646

    SHA1

    70fc16edf57e15567cd70f4d919c93dbbb072dbc

    SHA256

    c05a79296d61e3b2a2ebaf5af476839b976d69a5acb6f581a667e60e681049a2

    SHA512

    c6dd35579b664e37721d470b2e3c4d8ab681a1bc32c4994b1ca9e5e042fbc21a78f4a3ba775d01b919f8dbbaad08f9eecf6f8dbb7f0224fb72b819b615993011