Analysis
-
max time kernel
169s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
22-05-2024 09:06
Static task
static1
Behavioral task
behavioral1
Sample
mgsProMob_P500_V1_debug.apk
Resource
android-x86-arm-20240514-en
General
-
Target
mgsProMob_P500_V1_debug.apk
-
Size
40.7MB
-
MD5
c0e1a0b126f2e0a869828b9dad9952a7
-
SHA1
04ac4e88af4a29154d78d038ec65f0ef661b2d64
-
SHA256
34cf4c116d03231715b4a5071acc361e4aa182e2f147f2b3c249a6b0099f2a66
-
SHA512
a76c368ad8c621711f1d7fc11970ff0498fbde9183481bc779cd7b1786a16c41946e697e2e5b110cd486fe7d0d0caba8c3a332d919357479b47e089896a783c0
-
SSDEEP
786432:lLdyxk3/rQF++5jg+qpKIej6Ikw+bRqJajwqjwfR+Bkh/+bRqJiCeMRrYRAEzRXq:lLwxWck/Xf4CZNqJijgIah2NqJiCeMis
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.android.mgsmobioc process /system/app/Superuser.apk com.android.mgsmob /system/xbin/su com.android.mgsmob -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks Android system properties for emulator presence. 1 TTPs 3 IoCs
Processes:
com.android.mgsmobdescription ioc process Accessed system property key: ro.product.model com.android.mgsmob Accessed system property key: ro.product.name com.android.mgsmob Accessed system property key: ro.product.device com.android.mgsmob -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.android.mgsmobdescription ioc process File opened for read /proc/cpuinfo com.android.mgsmob -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.android.mgsmobdescription ioc process File opened for read /proc/meminfo com.android.mgsmob -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.android.mgsmobdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.android.mgsmob -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.android.mgsmobdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.android.mgsmob -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 1.0.0.1 -
Acquires the wake lock 1 IoCs
Processes:
com.android.mgsmobdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.android.mgsmob -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.android.mgsmobdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.android.mgsmob -
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.android.mgsmobdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.android.mgsmob
Processes
-
com.android.mgsmob1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4263
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.android.mgsmob/databases/BBDatabase.db-journalFilesize
512B
MD5c485c83583fad3782ebdeafa8124aa30
SHA1af481ab3f60aa36472d4d197674ab37d79275a98
SHA256625feb7152900e4a1d3f9808636b9817af3c35ff6cd488020867305dbddabe87
SHA5120812ffd5caee38b4080b39094cd199b55152e7ef32afcbb52cf70cedf8a6880858f9e1f42a5029ea49379da13aec0c42e418cfb941839256e6fcb6c46097ea7f
-
/data/data/com.android.mgsmob/databases/BBDatabase.db-walFilesize
32KB
MD59a8240c6eb20f1cf0d2fca3b5cb32c09
SHA13868122e67558050492e78e68b83445bbd26e667
SHA256926bacefe1252146a96d2ffeef0d821b795ccdbf8c5107924d02bf7dbb90b59d
SHA512bf659fc371ae5fe325ee3f9534f3add696393ae60fd1d35fc0308edfff6c54c10b08a7db609283e00e745208dd3e0c2e8de147a7fa42560baaaa7716e8281420
-
/data/data/com.android.mgsmob/databases/addb-journalFilesize
512B
MD518fd4a8d9a6b7273cb0b71462de0f7c5
SHA15cda14babb3190b962b7fe0f02afd938781b13ba
SHA25634bfc40d27eede7086e8d88c472194401c5029f2a6d618c1c5730c20f4008329
SHA5126b55c00d7aa62388e0dbf9e5a5adced0cdfc314e3652e114d00f23fcf244bd80d58c94d9b5385e8528a4c441cee63604ef368606e62896cc9b6ef418a3719be8
-
/data/data/com.android.mgsmob/databases/addb-walFilesize
32KB
MD532089d98bc38f93b1ad33058a459de25
SHA1b61c1a1fec1592674a461e3b36e6f459c6d15904
SHA256cbbd38cbd274ab685638c8fffa570bc78934440b81430c78578a89eb0a35f34d
SHA512a3ddedc3353a8dea8de6864877c27f0afe4e261dc412cb118b40f636c349152c4b78477d5c65ef714db439212933d5692030b6a946abb624cec08025d664c5d3
-
/data/data/com.android.mgsmob/databases/com.google.android.datatransport.eventsFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.android.mgsmob/databases/com.google.android.datatransport.events-journalFilesize
512B
MD518b1d16d22d5654435c52c98cc0e1eff
SHA11d9fa6b6e8dde374e8c02067b9298d4a0fdde7d3
SHA256f1b41d409b17d586b799e4f3232cbbf0bbec8ae994c1376a9bf2428473870623
SHA5121959780a2e9590788f6d57e08e38903f9d1f357d31a4b630fcb5f1f5679cb3ee0c3e1051ca5b10972ef1859e69bc5ca37e3ac0aa27f1c8e5a8a78c68c461fac5
-
/data/data/com.android.mgsmob/databases/com.google.android.datatransport.events-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.android.mgsmob/databases/com.google.android.datatransport.events-walFilesize
52KB
MD5c19170a688356b89e62620852a525704
SHA1759026419474f76259a6f4167469ccc8f7cf4f6f
SHA256f5051b59fe33a083738fef8e9341cecc223a8f04d2d5dcf2ac924b6459ad52f9
SHA51248808e2396cf83a97fabd63b5fca24ab3946ad44745d35908da1bf89b20ddd9b47fb2a0cb689a4629fd7620b08e2e0325d85f5c7a68be33b6290a6c5c69e6278
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.dbFilesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.dbFilesize
16KB
MD540c3e5ea0e393fcc410dc3520e754612
SHA143237d90736ad597f505f369e753d2c0a6ba7d5f
SHA256120a00b4ce2dde5779d328e955fa2f193e90f222aca54b5eee7ea4c1a5c8ca6d
SHA512d0bad3063eced8f06d12e9e851fbf0171e2fe2d4511148208bcb2bb7d816bfb05743952d5e96110bbca1e3a653d7772cff13d7350632ed4d57c915c4b5625969
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.dbFilesize
16KB
MD51cf9263db2d9fe13ca21ef2aad858e39
SHA18021fd109c12feb07f43b3f2e6f2ec4c6acbf27e
SHA256570ffd7ec79736e4058ee8d43be75899a1688956f1b1cba04e51323ebe0ad28c
SHA512894a63f31027abc53bd6b7d38d1ae9a19cf9ca909dd07158b1546e79a9bfe5061fb97e1d46720160d4ffde35918bde451f55c00c247ca829c4ca5f4a99b02cdb
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.dbFilesize
16KB
MD524505fe0515865c2a257203288b6d7f2
SHA1817a113ef54a6ac992ff93dfae6a5ac957563ea2
SHA256546a212f0916c44b4f7bdd65114d86f24a5b5993d421cc4880a22ceea90d3319
SHA512bf9b7add4ca5a951afec7a4240ca5f16da2d87936bfe20da4b45afebccf23a5e3991545a420f3377b742a73d578c310c43d32e72752075f8c78eeb0f700fcd6d
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.dbFilesize
16KB
MD57023283d63b86e337e7cb0c6e0d15ff0
SHA17917bd3e1826a32f8251589d4dac6912a0f85083
SHA256a951ca90c2215eea1a653cddd1aa0b273728cf7e66109b755eb3071dd596f1a1
SHA512f5669e4269d242d6053b03127ba931d7306cd241145e20cbb27d0a2b463b976a602c15f843de2d5fa8c798111cc855940fef72cdc419fb4245ceb871727c1753
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.dbFilesize
16KB
MD5d0efc47ccc1b0d30b0530f1fb696baf0
SHA1fe66d16beea26f9a485cb57b475dc88b6de0bd26
SHA2564e4c27ff6098c9d35fafb87b383852b32f9542aab8ec6972242685a3ea42db18
SHA512ea75e0d982c38d19da884da576c37c171056a1c23c0676800a94fb4708b7efc06a804f7b1223054287cc341bc575eb9b284788754bf53addaa4551ba40ad9d5a
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-journalFilesize
512B
MD56ad0d36e03c221f637e32947d5e00bc7
SHA1ee3c87d50992e5d37610db53471fd90a8aeb3a75
SHA256bc207b2878c6b9b4a2cc40dea090815570482ebbd3e13ef4fed21e41315d7597
SHA512982de95c4033127313121924bfc7a7533278a33237de199fdee799d6e516fc3a65bb8a086957da20ed09df200d00cd57aeee33bab09f727876c00c8c7a905e18
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-walFilesize
36KB
MD514f417a4f10cf4683d087ac937200e74
SHA1e6ce41efffe76bd57d4648652b7f4a1809e83547
SHA256b00637d2554a94cbc81c44a1122605d5a988941fd527c96f4d7852695068e858
SHA5122bbcd5607aaefaeb0afdbb176dd3c9f805f98ab2c07c298a071751974a43ff2478705f0f9c69233e70587feb8b9a7f97cec816defa4e7c890cb92bbac1d89ed5
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-walFilesize
4KB
MD5b8d792474730c15d996ad3bf69b7f468
SHA1c34ee496f81ad317aa21e3190240ef7c4cac781c
SHA256cd5111c53c785ef0a9e91682905272a204262e8975bd8e6c27240d07251229cd
SHA512006a4d8f7332601c9402dbdf84418d4200cc0dd966b09359fe8896f3b70db7beced00eb5fd45052c1b9908ab01c9b60ef6666ab303a1581f2c1eea47b9f005d8
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-walFilesize
4KB
MD50bd399089c955fa9a3d41a962664f798
SHA18907ad1758eeaa51e54668862383bf059aeabb5a
SHA25615c0bfa3ce3e23d240bb317c6f784256746ada635b578546af9512422d5c9d2f
SHA512171e588b2d8521fc1ef291eb342e7c6d96dd077a4ac6be8770c458125fb7b544fea74767d43822d9fb2375e84f3d578e5cf711030fef30e53028c1869358b279
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-walFilesize
4KB
MD50fb571221ed6865c9c0e7ebf6da063b6
SHA10bc7c3a6c8fac2c308a53017073d20a4843845fb
SHA256895b92bc00eb17b8e213fc4ee3b78f3e0a5f0d6aea489a495d897e5274150739
SHA5128ad2756773d6552593355cc518fc9cf84adc420067130b70d3a93390b5951334ab5a315bb6be3f5f9843544b756804333d42eca29b2a338dbd7b29b3e2bb4d2f
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-walFilesize
4KB
MD52f408229fd87be43817b0e12138c04a3
SHA10d5f4905d8f3a22eeb1dfacb4ca3b14e1f239e74
SHA25610fa342a022015d8fd65daa0deaa417390a5c22f5a3acd4813602a1edb5331c4
SHA5128fa0f717634a8b7e84d2f8677097802aa7dbbc04686f2edf33c81b4d2f1eb8e807c7e9f02f8bbfb2f0b80066550efe1a1b50b0374cd95731ac31730b475ecaaf
-
/data/data/com.android.mgsmob/databases/google_app_measurement_local.db-walFilesize
4KB
MD583740b8c0fbc38affdbf8454850e274c
SHA1c4d4f997f3b874775e303b7a32e63acff04843c1
SHA256255b42915de68553384aef295142a6fd32cf980783d135f188fd2b49454284db
SHA512e6226204a77ad888409f195cb1d892230ea7a65b8267f090fcc8e001d283dfabadcf499ce77f40a7321253a9d4e9f24f599a89b61b1168a79de7505f2f7aa62f
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/app.jsonFilesize
179B
MD5c1d41fd0beae346a3684d90ea0b5b917
SHA161b05a044885a08c8397e20c45362a5fa2c2ff73
SHA256d035a1d01bb7553b73e9b586c19748e1310736128a6278056c071006f75a4641
SHA512e12ff653f4faec3ee1a1f6bd1924c40ab76192030eca115ad7a13701e54bb681573262af682da44efde4cd0d1fb677a49dd1f53b10d4a6ee8f2635afb0ea0518
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/device.jsonFilesize
193B
MD5488b1489ac4d3b89d10d3f873727ee41
SHA1f65273aa79f9d0205c11dcaaf257457d85a68ed9
SHA25625189431ccb3f67616108f0cafbb993d864566d63fc9c19b3e1b86f863a7c54e
SHA5127493d142c751abfea8b4088f8cb72491ff48864cc2ab189d63a38a57ad5babb475c44165775834620a877aec7781f2247f59bd3427c27d2e805797de25522b59
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/os.jsonFilesize
54B
MD593023624eb8dff5c20050da136aaae0a
SHA1acfd1ffed752c28fb135ba83c0c6345ddf2f6995
SHA256968bcd7c4f1abed89a09cc0e6dadd238a81e8655e64196b39a86be49ceecd39c
SHA512bb25dfa144d3f0e17203936c503c5fedec5f9ca710e177f99e273010ba4a682199d4bda5684151d65f3cb1549f4611b3a645ce39646d3db9a1b2c17d6b160579
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics-ndk/664DB5C7020D000110A7BE8C4DD20F9D/session.jsonFilesize
127B
MD510fbfbb5c5b57df841e71f9c597b2246
SHA1ae6acab786d1fe0146e0de4f306a0a70088e9659
SHA256788d188fba89c2cffb16ee50faa7f541a075d9974812638f4defa333b1e53714
SHA512c6fb667d30e2db4837a044aff1f9b72fa584fcd1a4fadd4c962cad30d5470ae5e0fbdc59597c906dc0dbeeafc47c8b6bce566a0c00faf23388c10ddff4e09cf9
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/com.crashlytics.settings.jsonFilesize
716B
MD55a287f32d006d909e321267314728012
SHA10319a33d3ef292ccf753d6ca545e5b928e355d14
SHA25696447574eb99cca7c92cafe73ae026cba33b1d8d6556f491576193063cdd1210
SHA5122e1569b8761b704e0a17a38922cf0276d51d89f2db9f39b532cfa2f7240ef8a6239b00f4942114de8fad33f68d8ea225b6e19a450359b03bd73779c8af65dda2
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DB5C7020D000110A7BE8C4DD20F9D.tempFilesize
441B
MD572aef8bd2745ab0a4f51687d7477dcfe
SHA19c6d9ad4698a52ac0ff995ff8a0c04d8b22621f5
SHA25688134dad414c1626ade6b7643d9f1aaab337170b7cdec53326bf74bc3d07e18e
SHA51249006527d9041f2dc291eb580e32ab37a149b45956d41b5a235c5574f38d4cd97316afc954fd354f02e0acc0287dfa38854e76e68b8e9279cec070d49b86cd8f
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DB5C7020D000110A7BE8C4DD20F9D.temp.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.android.mgsmob/files/.com.google.firebase.crashlytics/report-persistence/sessions/664DB5C7020D000110A7BE8C4DD20F9D/reportFilesize
751B
MD51e19aade99e8f6dc78854965b66018d9
SHA16e18e0d9ee6053016d7066c08c28ea032380eaa8
SHA256072c372d64f46078ff774438f7d43aff3b6c0dad1c8e6334e732f19881da0d59
SHA5129159f4eceff4256aef00fed8060117ceec3122b3e10aec17c096e206acfb97bdf198e11ac529bbec0642b24c0b8e2df1b4c38b6cbd081f0721ffa02dc364b757
-
/data/data/com.android.mgsmob/files/PersistedInstallation7854404127048426016tmpFilesize
569B
MD53bba75aa821e25cd27d7ecee77578675
SHA12cb2b5eee2edf96a4438c721b872525e8c49fa9c
SHA25626645eb9ce603727688e5a1f8b3009b8be0eea7196aaf273b3f1d6af6942f65d
SHA512baf4ecd228d7e1989c363df1fad699fc112d017a74250608c706ac0ea0b5665d8ed18e58ec2d3fb631a1dab25ba2176edca11c1553c98525f718fea0537deffe
-
/data/data/com.android.mgsmob/files/PersistedInstallation8975163905723324372tmpFilesize
90B
MD5374b5cc1e89e636ce47921a2ed84e2ab
SHA13c49cbfd65de491236440c6101cf350e9588e130
SHA25653e1659acbb0252951674c352aa0c3f5ec02a3611b495e5943509ee1b76bd59f
SHA512041eb6b064d440f673e2231dca7cf27222fb17597ce7abcf2b6caef8d2245b46b50951a3e812300d945ad2ffc5c8b678a326c6b80f62bcbfe6fa38ed3798bb4e
-
/data/data/com.android.mgsmob/files/cacert.pemFilesize
221KB
MD5be2b0736ea029fff398559fa7df4e646
SHA170fc16edf57e15567cd70f4d919c93dbbb072dbc
SHA256c05a79296d61e3b2a2ebaf5af476839b976d69a5acb6f581a667e60e681049a2
SHA512c6dd35579b664e37721d470b2e3c4d8ab681a1bc32c4994b1ca9e5e042fbc21a78f4a3ba775d01b919f8dbbaad08f9eecf6f8dbb7f0224fb72b819b615993011