Resubmissions

13/06/2024, 06:22

240613-g4zwcs1epq 8

13/06/2024, 06:15

240613-g1bz5a1dml 8

Analysis

  • max time kernel
    48s
  • max time network
    161s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    13/06/2024, 06:15

General

  • Target

    Mega GO_1.4.7_APKPure.apk

  • Size

    17.6MB

  • MD5

    1d1123bc3d49c299f3d3e61fb254511d

  • SHA1

    b4f7b80871e4d3c687d2c79d2a2ff3489a01ade9

  • SHA256

    711759fc4628278d6468148ea65b701fb4cdc0c40e9b73b38591f801b1da3b60

  • SHA512

    e7993e3cd72b7a0420bd7f68d066e5a1bb6bca89e36c737dfd4da52390086c8198a7232567616a8fe46184c134db654ad0ced00b561b5b7064eb1902d7717f8e

  • SSDEEP

    393216:yzLpXI4M/7l5sozBLKCtPykNGDJoze7NJ04XmsI2blr/essBow:ULpR4J35KCtPjUCe7MUmRKlr/4D

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • cl.megamedia.megago
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5160

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/cl.megamedia.megago/cache/image_manager_disk_cache/bb3e4479426474e9a778b21d7ac05f6754da8ea83e33e2fb010bfa740390bbd6.0.tmp

    Filesize

    239KB

    MD5

    4c5f85b4e1609f71bd974a3196570a4c

    SHA1

    203e562d931a467cc1b0984d32f91d73354203e4

    SHA256

    eef743e9724b4879828051abe0816a02ac43e70b3622ef9d0162d63bb576090f

    SHA512

    e71ca4e3c2cd65f7af568e2e608fb10e90abad0f2569d5393c21aef73e40c98dac8ef6c1f68ce455839966d7157bf7ba69fadfbb251af3e3f23bfdbf3fe58454

  • /data/data/cl.megamedia.megago/cache/image_manager_disk_cache/cde05719c1d78615c9ec390c2fb5230d0540fb5e7b54e11c0ecf25d2d09fde91.0.tmp

    Filesize

    228KB

    MD5

    fa5af761be6df6e5bd949bd6cf8428fb

    SHA1

    03ab06b51f207045f974e22e8905b083c2f7d58d

    SHA256

    c680df0658747a539f46509872d4b7c7ae596f0e70b8beb80d0c13257d7a726e

    SHA512

    80a69e62fc8db6fc2be86a92dbeb119b3d5b8d0d18654dbab9556ac5f7a3a7bd9185e08cb327cb513409c5c8b70e8fd409a95c8d410ddb89f012a23262fb947b

  • /data/data/cl.megamedia.megago/cache/image_manager_disk_cache/journal

    Filesize

    469B

    MD5

    58928523a39e669bf388ad96b7de2e31

    SHA1

    907f0324b174a07f079bcff3027ed41cdd2551ba

    SHA256

    d536a3ef38b7845837ce572be77241d648f2d6e05102e682e1e650774bf1caf7

    SHA512

    7f14d5304d770808dcfd677bbd453cdf6f3be48a21ae7c40e28060b44fb704e97e7b3fd58d4e88815f64ed00bb13b053cfc1985f9067bd48b3f6e0f185168d7b

  • /data/data/cl.megamedia.megago/cache/image_manager_disk_cache/journal.tmp

    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    1046fc10d7539906ca7f8a845e2c25c1

    SHA1

    6b143b6fdd17e69fe6cc9fa5f0e873b62c8960d4

    SHA256

    2e72296e1607a91d15081d952e6f61bf4f10720688f422790bcbb1c727d508d9

    SHA512

    a6089f2b12181f5a1e446390e4f371026257f8c4c603ed1137fccf0ac51a0abec0cca741666b16b77b16fd25baabd0f7b22afefdf6856e211211d063cd193051

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events-journal

    Filesize

    24KB

    MD5

    de8c4794767524182a827f651f7736ed

    SHA1

    10c5b17cd26969bd2d82a32f85be83003e0814ff

    SHA256

    924a296dcc5daa5f484d63daacfb1443d1fa05c2dbf8f7395c0f1fc3648a1e56

    SHA512

    e9f6cf44ceeac315d6601b206dfb343b303989a18af15a93f119255c1ff6823046c08ee65ae91d66c691cfd9304db42e8a352bcc6beb470584c4d28d8e555572

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    dfec53b1ec627d708356fd6c16d2849d

    SHA1

    58490dc88aedf4208c45b3dc73b1b9eeb1ee33a6

    SHA256

    cf61397a0d76ab7a5fff314d1a309af9cc3b8c8537497665f9d9b474b5c87a3d

    SHA512

    45a7153cba5531aff1b9b463c190dd75a02b15ccad6a3c48bb27d1a74a3e137242c7236adb302c9c95c1bf4d81ab1fc2ef1a5303d3b1d7a884ee791f4bbfd590

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    7e253ba5adb194baeba31ca31a94b401

    SHA1

    bc7359be26dccade189b371a07ea3d8bbd93fc6f

    SHA256

    b06b9aa780db04a54b2116157500c5417b17706c6134bb0883238f1c6821129f

    SHA512

    fe1a5e7e187bbd79e12e3bfedfda44175d459f0c9c00dd6351d3bce83d467f4bda47136f820a5609797602c7daba43b2f40888409f2796d0fba7008b583a50aa

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events-journal

    Filesize

    16KB

    MD5

    6dfc361570c347a0b1fd483af83de73d

    SHA1

    49cf14102229a1f59a96e51cd06f18f9ba27affb

    SHA256

    a5336d0e244d54b3f82c6b09288cdcda19e9db52b413e05796fb49430bb75ab4

    SHA512

    18511d7ef3390f28e48beb10d7c7ff484fd4f3901f928997bb5c0c156fd5393be33d4607288a2fa91d895acd0b7e15529bd07a9789ba6f4be21dc5720fbba8d4

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events-journal

    Filesize

    20KB

    MD5

    573738a6383edf493239a89ab3999b69

    SHA1

    a2d064d6e1de82738bc24993463300ef165a36f7

    SHA256

    2f4f40a2f537643e46496fbdb09fccb2752d96248915e1319771fcab5b83c702

    SHA512

    72c869b28b69a93880c940de929d0db16c39059004bd3b8966413f97ca59e00335ed4b221992f6bf9af63b7bce4d565d7252e8529ce7d787b3ffa931c44a5729

  • /data/data/cl.megamedia.megago/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    67ca79719914423f6fb326ca3a69a014

    SHA1

    e14811d6118f97a6c82a629ed83fdda637251a6b

    SHA256

    4222510d16071d7264ef6cf16a5d9bf8f02c87ed6ca7cf62762dabbf9cda7e65

    SHA512

    ff08fb831d5d47a385af737b59cef49fd8629ce2237fcebdd62bc43e9ec8601eeeec640a97109987ae8bcf925f7719dc06414c1b2625ce7e415f8192b40edca3

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    eb52a90bb70b76e946b62f50b6f7fb85

    SHA1

    42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

    SHA256

    48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

    SHA512

    b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    dd480664b762f0cb890d85c7f612d05b

    SHA1

    aafb5b7589c5e74986ad15a8deca2ae8a4ae95c4

    SHA256

    4ba90e5fd415a64ccbe0737a800e876209a6cffb9dfda7b98036a5cc67699f05

    SHA512

    3fab3ccc140efd02f5eaa241eff4927da155f6781820bb22f09e5a461ec564dd79d36a61aa959d90873432e635488aa840753758b02e8889edcd19b75d53829d

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    8b6e3afd0cfc58cf78e5ff4e028db329

    SHA1

    ac361267ac8c064439a49e57e264defacc89f10b

    SHA256

    57e691251199614728082195a041816152dfec9846e294e4ab0f9a9e19e8d717

    SHA512

    535d86c632394caeddcf2c37306d580d7b56c5f062774e85a3894781090b7744254530f69feaa79463b6880b3ed3e0fb1ef2ce9eaff4b7f9abd80fb9e4433ddd

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    5139c8a5758c43c4300454c287a843e6

    SHA1

    35387e01ac57f2815f786599bb839ef023c9f2d1

    SHA256

    531a86ec61bdf3c1d721506b294ec093e6ffa76215af06b19af7f9702bd91641

    SHA512

    f310b53b786002d496bd084ffb669907455874bb13eb5bcd1738b4f36bcc81b2bad25f0c7c4c8d9e1b782677cf09c0f1270d4a7828591d193228763c07acd284

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    b23314c13ea65f41e908abf8e66393ae

    SHA1

    4e4df9b2db37d96cbf1b50c22df2858fd42759d7

    SHA256

    acf508ead58ae65839912e1840283a8ee2b68ca20bbb7085b6d069f55f679015

    SHA512

    d482fbec05f53cd7d6f15e3f5c45b3ca3d295b628cc96f39ce614856c09d4661c4f5f5c8da9c751c48a92bbd005ffcf7b0a3011d8f9469799892c17f93282628

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    c1561958b5d9683711354c6bf9c57eba

    SHA1

    6ea139646692dba4583fd41d55e45218110b5dba

    SHA256

    b097c33e2a6a288b443b2c6aea05303918ce5ca35cea0663bd4d74791c33967b

    SHA512

    ec964895fb74cf60e6eb83ba433aaeb33897380965379e2147580d131cbd825951d05ab455c6643062094fe59bd9fa9267ed9d647c34607e2a261a13f86fe93e

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    29691d78623bda57317a7a70b407624c

    SHA1

    651da812b03783c334bc5e525469361f93cbc79f

    SHA256

    172e1067a7b95599be599b8a07e36607d657d1342e8469bd5ee8541afc4d5263

    SHA512

    4726499cf172a80561d4241cc97b1248cef1b55901dc5ea182850cc490f25c344e9fd41a74c8e8ebefcfc8dc07a8ad5aa186d2a2ccbb3c4c8bb36bc6b48f1413

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    53fb0b7b1758e32f7d99fdfbe9585bd3

    SHA1

    eda5d75a27c2d64b2a1d6d966c359cf8fe321154

    SHA256

    3a71ddf7204570980b9c3971a2b54184916d71bbffbed5f00f3948f259c87528

    SHA512

    686bea3a5cf2d4d083269e608d73e6cd06ff955192085263cff5aee3d1e38b2cf249b56c38ff355894d0a4dd505354fe2e6e5585390f3e875aa7cfd549347118

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    77a1db8c34c7085c97a89a14d6d188b0

    SHA1

    936ce1b6d90d87a59b9fbaf4f57e3a42c07f717c

    SHA256

    5c4adabd1da9802e0b3645f3d1b016d5e2557a1558f0f7fd130d53b83b037cf3

    SHA512

    548db984df97f76a8e03276ad5d1cf4914dd1efd677a341d7f0e936973c44fce6924b1704867e749726bafe30b8607787be7ca1dbdae3ac34ee4c6831727e5e4

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    09b7bca5fc04f322e6e7bc247658e92f

    SHA1

    12113062cdd7d35c66b85f8c8d94ea6d0c11f5c4

    SHA256

    3a91676cdbff24544457134552a17eacf5e3872770031bf4e81b5b785bb5299d

    SHA512

    7b5e48c518af600ab89dce8e8ab8cc01e939c62d92181e46bfc3ac6e1d03bbcd2c202eccccacdba5eeaa5baf818f4089a4571b2f7794d716aa99d7a1961479cc

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    c109c3b833f345dd28976b207ae06c7d

    SHA1

    30025c8fb988c101df5e98e13e6fcc2691352885

    SHA256

    15c4f223a3c1ecafb8c7b0af7036895c951eef5eafc797b2f14d78f97617130e

    SHA512

    1a6e11f75248194239568afbe21aa29ac66e63ffc1c2ed971e9e6daefe33e98fb79f1ba057b9efdd1fdac510f8df42fef67a533f1e460100e5fc70d5d56027f3

  • /data/data/cl.megamedia.megago/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    897e2dcc8d2e29b0727b797f05e74629

    SHA1

    f9817d6a449e3653d3e69e5f6a21e16d0476d2fd

    SHA256

    6e4a38087f2885e686979fdcf87da0cef7a58bd578fbe797df5d17a0ccdfc124

    SHA512

    486d5a2aaf58c9401f34e7a0978c989e4dd2573bc0b58b2c926fb17cbf5f9cd611cec00d352d964af01ff8d4d036fdf2a00750d66b3806f568a055b3aaf33f9b

  • /data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/com.crashlytics.settings.json

    Filesize

    715B

    MD5

    4b9c95180b451467f231bb255eb5fdad

    SHA1

    1f5952ee6bddb10c83de4941d719ae4cb069d0d4

    SHA256

    2122299c584a60ac2a5b675b9f7c65134d63425313f182846d658c0226d57e43

    SHA512

    a961be60ffa8f203b48505990bc89b8cdd9480332883f11528fabf33daa57fc687621cd6b0dbe9291937f39cb936ed6767b414107c278d1da55d0f0f88714018

  • /data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/open-sessions/666A8EC700AF00011428AA09000C04CD/report

    Filesize

    759B

    MD5

    1b9778177a75d7bc30de2eca86f1e519

    SHA1

    74e6d6a48193ebc74e825a9b8cc6c088b67ce745

    SHA256

    c65f606c1bf832f220a19d88705c04cc83f8053f9c9c3c342fd3d3487226d2a9

    SHA512

    00fe14bd71572cabd214fb616cfda9d4fd7b767a949629d53f7853f99fcf034daa4de1ebb0d72fa8ab8a28dd87038021c086e777edbce2f3e76f463946055a2e

  • /data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/open-sessions/666A8EC700AF00011428AA09000C04CD/userlog

    Filesize

    198B

    MD5

    78a2fcd0bf3620788531b8893ce0fc1e

    SHA1

    34e14aebc8e297e460ef30c204926e099e9a0ca8

    SHA256

    f718c92a7d95f6e5b98937c8dc72bdbd2836b6839fea744220ba76d15852f198

    SHA512

    4042947ffc2475eabbc2fdab2a2cff26811f8f2ca554d1f7ca3a76052303cf375e2d6da6a0b4f2180752922c2f20d0ac1004be1cfa3ab1dada1e1bc0f045d51a

  • /data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/open-sessions/666A8EC700AF00011428AA09000C04CD/userlog.tmp

    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/cl.megamedia.megago/files/PersistedInstallation3933933745721233612tmp

    Filesize

    568B

    MD5

    7f91e41dc796aaad3711f78c9225664d

    SHA1

    c459f25ae225fcf6bb69f81e4ede60f49795b3f4

    SHA256

    c5a1e0f693c75caaffc8b7f891fa71c26dc588edd031f448613f9175b7a74a97

    SHA512

    6b913990a5918f9346eb0d9ca12ab0b5cdd43be991d64a40230bb52657870caa6c85a63e1d8cc550206a5ee0822d52c9803b0a6d5140dca4b73ec325faae1b94

  • /data/data/cl.megamedia.megago/files/PersistedInstallation8967619483023858402tmp

    Filesize

    90B

    MD5

    74649b89289df7c5c631fb3479f48911

    SHA1

    93c93ed03722674eaa882d548fcb2d94623ed714

    SHA256

    d514119748e246b3bc7259130b62a6c347009f015287f817db87c2ffc7d91196

    SHA512

    56e9c852c4b102e556f5a6c69a1d518a0de81336cb6553b7fe15822cf2fe30ee357663417e634e32ecb3cc9376c0d6fc85c4e9d0a622d4a28e138ee7661f6c77

  • /data/data/cl.megamedia.megago/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/cl.megamedia.megago/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    e5203c81ffd9db01f73b0860c1f3f4d7

    SHA1

    0cb89e5b5c996add7ef3660450d8a1f2d10fe611

    SHA256

    80d357111da58b550c9bd6aa57f461aa48e345d51fc7a01f2587faa95be9f1c4

    SHA512

    1ea5c6a3c88ebfd11a05e720f17dca82fb5cce7666bff8d7daec909860a889d1a89d1d6f451b36dd2a2f0f6dfcffd6c306a3949be5548eaca78e8e1925678642

  • /data/data/cl.megamedia.megago/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/cl.megamedia.megago/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    1bdf0c4d75d03fabee7104b29c51b665

    SHA1

    895813b84b19bdef7ff89a7b3996f0062c58f803

    SHA256

    25f35864af792135fbfffc56e81ebe1281cb1d99812b359ea5f3e44f8d794698

    SHA512

    e1a8130c426e0619f8448a9f431e1f36638589508aa0bea1f08f519259a8ec0c147b0ededbbdc47a3ec6e5129eaaa739a3fb7a0a0ed5e732d458c62960fe016c

  • /data/data/cl.megamedia.megago/no_backup/androidx.work.workdb-wal

    Filesize

    112KB

    MD5

    566de71adda95fdb7344caf9b22e1966

    SHA1

    085131c42d911c6cd33f9d1e6893d263c2ca785b

    SHA256

    1d54f8d42cfb1909aac97627b56674c7c3bd9af4fe59fe8c6e868f0348a58a58

    SHA512

    23f6cb2b2334613dab5f6259d412cbdef8edccbd84b6086060300c825d32f9047bb799dd930d08cb019c2868358e118c77a95bf4d4b87e1f5fc96272cb257eb9

  • /data/data/cl.megamedia.megago/no_backup/androidx.work.workdb-wal

    Filesize

    120KB

    MD5

    9abcb64cbbafe34ef05e39012578b12f

    SHA1

    7ca42d0a7f111d1d664e12b5f94fd99751a2ec57

    SHA256

    384de29d298ec8131fd9362f5dc7b58b2dcce62ba04aaf24a01a00bb2b7fe136

    SHA512

    2509e0860569ae3c4805b9ba3e5e15e7f995077aeb75f3472e6f81bf34349a8e0f5d4e58de36c430c2abdea9a75b4c8ce0655344e466b77b63aeeb1695a99f19