04c06f6aa11948987713ef1f69532203bfab5c953ba72e3247fddaefcbb8f0db | Triage

Resubmissions

23/05/2024, 16:22 UTC

240523-tvbtdsgh3z 6

23/05/2024, 16:21 UTC

240523-ttr4zsgg9w 6

23/05/2024, 16:14 UTC

240523-tpxhxagf7t 7

Analysis

max time kernel
2s
max time network
255s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23/05/2024, 16:14 UTC

Sharing

Report Analysis Logs

General

Target

magis-celular.apk
Size

28.2MB
MD5

5db598cce404e50efe1f56cc4c178cfe
SHA1

11def3c597919b9dc013c7729a007c7e8a5b4a0c
SHA256

04c06f6aa11948987713ef1f69532203bfab5c953ba72e3247fddaefcbb8f0db
SHA512

c45b64b62f463dcd2ced14a171ca607abaa549e30e5de5e476cfd0c0e31c385b24386e9e61c8f2433c03705731a9e36869b6b902f7b7ffa626d3a17a72f5d598
SSDEEP

786432:sJZSPOVLQR/mRL581uD/V9CMOy9l5bhILYgImByh8e:sJfVL1581E/LCKDhJmByT

Score

7^/10

evasion

Malware Config

Signatures

Checks Android system properties for emulator presence. 1 TTPs 5 IoCs

System Checks

description	ioc	Process
Accessed system property	key: ro.bootmode	com.msandroid.mobile
Accessed system property	key: ro.hardware	com.msandroid.mobile
Accessed system property	key: ro.product.device	com.msandroid.mobile
Accessed system property	key: ro.product.model	com.msandroid.mobile
Accessed system property	key: ro.bootloader	com.msandroid.mobile

Checks Qemu related system properties. 1 TTPs 7 IoCs

Checks for Android system properties related to Qemu for Emulator detection.

System Checks

description	ioc	Process
Accessed system property	key: qemu.sf.fake_camera	com.msandroid.mobile
Accessed system property	key: ro.kernel.android.qemud	com.msandroid.mobile
Accessed system property	key: ro.kernel.qemu.gles	com.msandroid.mobile
Accessed system property	key: ro.kernel.qemu	com.msandroid.mobile
Accessed system property	key: init.svc.qemud	com.msandroid.mobile
Accessed system property	key: init.svc.qemu-props	com.msandroid.mobile
Accessed system property	key: qemu.hw.mainkeys	com.msandroid.mobile

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

System Checks

ioc	Process
/dev/socket/qemud	com.msandroid.mobile
/dev/qemu_pipe	com.msandroid.mobile

Checks the presence of a debugger
evasion

com.msandroid.mobile
1⤵
- Checks Android system properties for emulator presence.
- Checks Qemu related system properties.
- Checks known Qemu pipes.
PID:4275

Network

DNS

semanticlocation-pa.googleapis.com

Remote address:

1.1.1.1:53

Request

semanticlocation-pa.googleapis.com

IN A

Response

semanticlocation-pa.googleapis.com

IN A

142.250.179.234

semanticlocation-pa.googleapis.com

IN A

172.217.169.74

semanticlocation-pa.googleapis.com

IN A

142.250.200.10

semanticlocation-pa.googleapis.com

IN A

216.58.201.106

semanticlocation-pa.googleapis.com

IN A

142.250.187.234

semanticlocation-pa.googleapis.com

IN A

216.58.212.234

semanticlocation-pa.googleapis.com

IN A

142.250.178.10

semanticlocation-pa.googleapis.com

IN A

216.58.212.202

semanticlocation-pa.googleapis.com

IN A

142.250.200.42

semanticlocation-pa.googleapis.com

IN A

172.217.169.42

semanticlocation-pa.googleapis.com

IN A

142.250.180.10

semanticlocation-pa.googleapis.com

IN A

172.217.169.10

semanticlocation-pa.googleapis.com

IN A

142.250.187.202

semanticlocation-pa.googleapis.com

IN A

216.58.204.74

semanticlocation-pa.googleapis.com

IN A

172.217.16.234
DNS

android.apis.google.com

Remote address:

1.1.1.1:53

Request

android.apis.google.com

IN A

Response

android.apis.google.com

IN CNAME

clients.l.google.com

clients.l.google.com

IN A

172.217.16.238

216.58.204.67:443

tls, https

128 B
40 B
2
1
142.250.180.14:443

tls, https

858 B
40 B
1
1
172.217.16.238:443

android.apis.google.com

tls

5.6kB
10.0kB
16
26

224.0.0.251:5353

3.7kB
11
1.1.1.1:53

semanticlocation-pa.googleapis.com

dns

80 B
320 B
1
1

DNS Request

semanticlocation-pa.googleapis.com

DNS Response

142.250.179.234

172.217.169.74

142.250.200.10

216.58.201.106

142.250.187.234

216.58.212.234

142.250.178.10

216.58.212.202

142.250.200.42

172.217.169.42

142.250.180.10

172.217.169.10

142.250.187.202

216.58.204.74

172.217.16.234
1.1.1.1:53

android.apis.google.com

dns

69 B
109 B
1
1

DNS Request

android.apis.google.com

DNS Response

172.217.16.238

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads