Analysis
-
max time kernel
48s -
max time network
161s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system -
submitted
13/06/2024, 06:15
Static task
static1
Behavioral task
behavioral1
Sample
Mega GO_1.4.7_APKPure.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
Mega GO_1.4.7_APKPure.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
Mega GO_1.4.7_APKPure.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
Mega GO_1.4.7_APKPure.apk
-
Size
17.6MB
-
MD5
1d1123bc3d49c299f3d3e61fb254511d
-
SHA1
b4f7b80871e4d3c687d2c79d2a2ff3489a01ade9
-
SHA256
711759fc4628278d6468148ea65b701fb4cdc0c40e9b73b38591f801b1da3b60
-
SHA512
e7993e3cd72b7a0420bd7f68d066e5a1bb6bca89e36c737dfd4da52390086c8198a7232567616a8fe46184c134db654ad0ced00b561b5b7064eb1902d7717f8e
-
SSDEEP
393216:yzLpXI4M/7l5sozBLKCtPykNGDJoze7NJ04XmsI2blr/essBow:ULpR4J35KCtPjUCe7MUmRKlr/4D
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk cl.megamedia.megago /system/xbin/su cl.megamedia.megago -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses cl.megamedia.megago -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock cl.megamedia.megago -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo cl.megamedia.megago -
Reads information about phone network operator. 1 TTPs
-
Checks the presence of a debugger
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule cl.megamedia.megago -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal cl.megamedia.megago -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo cl.megamedia.megago
Processes
-
cl.megamedia.megago1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5160
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/cl.megamedia.megago/cache/image_manager_disk_cache/bb3e4479426474e9a778b21d7ac05f6754da8ea83e33e2fb010bfa740390bbd6.0.tmp
Filesize239KB
MD54c5f85b4e1609f71bd974a3196570a4c
SHA1203e562d931a467cc1b0984d32f91d73354203e4
SHA256eef743e9724b4879828051abe0816a02ac43e70b3622ef9d0162d63bb576090f
SHA512e71ca4e3c2cd65f7af568e2e608fb10e90abad0f2569d5393c21aef73e40c98dac8ef6c1f68ce455839966d7157bf7ba69fadfbb251af3e3f23bfdbf3fe58454
-
/data/data/cl.megamedia.megago/cache/image_manager_disk_cache/cde05719c1d78615c9ec390c2fb5230d0540fb5e7b54e11c0ecf25d2d09fde91.0.tmp
Filesize228KB
MD5fa5af761be6df6e5bd949bd6cf8428fb
SHA103ab06b51f207045f974e22e8905b083c2f7d58d
SHA256c680df0658747a539f46509872d4b7c7ae596f0e70b8beb80d0c13257d7a726e
SHA51280a69e62fc8db6fc2be86a92dbeb119b3d5b8d0d18654dbab9556ac5f7a3a7bd9185e08cb327cb513409c5c8b70e8fd409a95c8d410ddb89f012a23262fb947b
-
Filesize
469B
MD558928523a39e669bf388ad96b7de2e31
SHA1907f0324b174a07f079bcff3027ed41cdd2551ba
SHA256d536a3ef38b7845837ce572be77241d648f2d6e05102e682e1e650774bf1caf7
SHA5127f14d5304d770808dcfd677bbd453cdf6f3be48a21ae7c40e28060b44fb704e97e7b3fd58d4e88815f64ed00bb13b053cfc1985f9067bd48b3f6e0f185168d7b
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
56KB
MD51046fc10d7539906ca7f8a845e2c25c1
SHA16b143b6fdd17e69fe6cc9fa5f0e873b62c8960d4
SHA2562e72296e1607a91d15081d952e6f61bf4f10720688f422790bcbb1c727d508d9
SHA512a6089f2b12181f5a1e446390e4f371026257f8c4c603ed1137fccf0ac51a0abec0cca741666b16b77b16fd25baabd0f7b22afefdf6856e211211d063cd193051
-
Filesize
24KB
MD5de8c4794767524182a827f651f7736ed
SHA110c5b17cd26969bd2d82a32f85be83003e0814ff
SHA256924a296dcc5daa5f484d63daacfb1443d1fa05c2dbf8f7395c0f1fc3648a1e56
SHA512e9f6cf44ceeac315d6601b206dfb343b303989a18af15a93f119255c1ff6823046c08ee65ae91d66c691cfd9304db42e8a352bcc6beb470584c4d28d8e555572
-
Filesize
512B
MD5dfec53b1ec627d708356fd6c16d2849d
SHA158490dc88aedf4208c45b3dc73b1b9eeb1ee33a6
SHA256cf61397a0d76ab7a5fff314d1a309af9cc3b8c8537497665f9d9b474b5c87a3d
SHA51245a7153cba5531aff1b9b463c190dd75a02b15ccad6a3c48bb27d1a74a3e137242c7236adb302c9c95c1bf4d81ab1fc2ef1a5303d3b1d7a884ee791f4bbfd590
-
Filesize
8KB
MD57e253ba5adb194baeba31ca31a94b401
SHA1bc7359be26dccade189b371a07ea3d8bbd93fc6f
SHA256b06b9aa780db04a54b2116157500c5417b17706c6134bb0883238f1c6821129f
SHA512fe1a5e7e187bbd79e12e3bfedfda44175d459f0c9c00dd6351d3bce83d467f4bda47136f820a5609797602c7daba43b2f40888409f2796d0fba7008b583a50aa
-
Filesize
16KB
MD56dfc361570c347a0b1fd483af83de73d
SHA149cf14102229a1f59a96e51cd06f18f9ba27affb
SHA256a5336d0e244d54b3f82c6b09288cdcda19e9db52b413e05796fb49430bb75ab4
SHA51218511d7ef3390f28e48beb10d7c7ff484fd4f3901f928997bb5c0c156fd5393be33d4607288a2fa91d895acd0b7e15529bd07a9789ba6f4be21dc5720fbba8d4
-
Filesize
20KB
MD5573738a6383edf493239a89ab3999b69
SHA1a2d064d6e1de82738bc24993463300ef165a36f7
SHA2562f4f40a2f537643e46496fbdb09fccb2752d96248915e1319771fcab5b83c702
SHA51272c869b28b69a93880c940de929d0db16c39059004bd3b8966413f97ca59e00335ed4b221992f6bf9af63b7bce4d565d7252e8529ce7d787b3ffa931c44a5729
-
Filesize
8KB
MD567ca79719914423f6fb326ca3a69a014
SHA1e14811d6118f97a6c82a629ed83fdda637251a6b
SHA2564222510d16071d7264ef6cf16a5d9bf8f02c87ed6ca7cf62762dabbf9cda7e65
SHA512ff08fb831d5d47a385af737b59cef49fd8629ce2237fcebdd62bc43e9ec8601eeeec640a97109987ae8bcf925f7719dc06414c1b2625ce7e415f8192b40edca3
-
Filesize
16KB
MD5eb52a90bb70b76e946b62f50b6f7fb85
SHA142d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA25648472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
-
Filesize
16KB
MD5dd480664b762f0cb890d85c7f612d05b
SHA1aafb5b7589c5e74986ad15a8deca2ae8a4ae95c4
SHA2564ba90e5fd415a64ccbe0737a800e876209a6cffb9dfda7b98036a5cc67699f05
SHA5123fab3ccc140efd02f5eaa241eff4927da155f6781820bb22f09e5a461ec564dd79d36a61aa959d90873432e635488aa840753758b02e8889edcd19b75d53829d
-
Filesize
16KB
MD58b6e3afd0cfc58cf78e5ff4e028db329
SHA1ac361267ac8c064439a49e57e264defacc89f10b
SHA25657e691251199614728082195a041816152dfec9846e294e4ab0f9a9e19e8d717
SHA512535d86c632394caeddcf2c37306d580d7b56c5f062774e85a3894781090b7744254530f69feaa79463b6880b3ed3e0fb1ef2ce9eaff4b7f9abd80fb9e4433ddd
-
Filesize
16KB
MD55139c8a5758c43c4300454c287a843e6
SHA135387e01ac57f2815f786599bb839ef023c9f2d1
SHA256531a86ec61bdf3c1d721506b294ec093e6ffa76215af06b19af7f9702bd91641
SHA512f310b53b786002d496bd084ffb669907455874bb13eb5bcd1738b4f36bcc81b2bad25f0c7c4c8d9e1b782677cf09c0f1270d4a7828591d193228763c07acd284
-
Filesize
16KB
MD5b23314c13ea65f41e908abf8e66393ae
SHA14e4df9b2db37d96cbf1b50c22df2858fd42759d7
SHA256acf508ead58ae65839912e1840283a8ee2b68ca20bbb7085b6d069f55f679015
SHA512d482fbec05f53cd7d6f15e3f5c45b3ca3d295b628cc96f39ce614856c09d4661c4f5f5c8da9c751c48a92bbd005ffcf7b0a3011d8f9469799892c17f93282628
-
Filesize
16KB
MD5c1561958b5d9683711354c6bf9c57eba
SHA16ea139646692dba4583fd41d55e45218110b5dba
SHA256b097c33e2a6a288b443b2c6aea05303918ce5ca35cea0663bd4d74791c33967b
SHA512ec964895fb74cf60e6eb83ba433aaeb33897380965379e2147580d131cbd825951d05ab455c6643062094fe59bd9fa9267ed9d647c34607e2a261a13f86fe93e
-
Filesize
512B
MD529691d78623bda57317a7a70b407624c
SHA1651da812b03783c334bc5e525469361f93cbc79f
SHA256172e1067a7b95599be599b8a07e36607d657d1342e8469bd5ee8541afc4d5263
SHA5124726499cf172a80561d4241cc97b1248cef1b55901dc5ea182850cc490f25c344e9fd41a74c8e8ebefcfc8dc07a8ad5aa186d2a2ccbb3c4c8bb36bc6b48f1413
-
Filesize
8KB
MD553fb0b7b1758e32f7d99fdfbe9585bd3
SHA1eda5d75a27c2d64b2a1d6d966c359cf8fe321154
SHA2563a71ddf7204570980b9c3971a2b54184916d71bbffbed5f00f3948f259c87528
SHA512686bea3a5cf2d4d083269e608d73e6cd06ff955192085263cff5aee3d1e38b2cf249b56c38ff355894d0a4dd505354fe2e6e5585390f3e875aa7cfd549347118
-
Filesize
4KB
MD577a1db8c34c7085c97a89a14d6d188b0
SHA1936ce1b6d90d87a59b9fbaf4f57e3a42c07f717c
SHA2565c4adabd1da9802e0b3645f3d1b016d5e2557a1558f0f7fd130d53b83b037cf3
SHA512548db984df97f76a8e03276ad5d1cf4914dd1efd677a341d7f0e936973c44fce6924b1704867e749726bafe30b8607787be7ca1dbdae3ac34ee4c6831727e5e4
-
Filesize
8KB
MD509b7bca5fc04f322e6e7bc247658e92f
SHA112113062cdd7d35c66b85f8c8d94ea6d0c11f5c4
SHA2563a91676cdbff24544457134552a17eacf5e3872770031bf4e81b5b785bb5299d
SHA5127b5e48c518af600ab89dce8e8ab8cc01e939c62d92181e46bfc3ac6e1d03bbcd2c202eccccacdba5eeaa5baf818f4089a4571b2f7794d716aa99d7a1961479cc
-
Filesize
8KB
MD5c109c3b833f345dd28976b207ae06c7d
SHA130025c8fb988c101df5e98e13e6fcc2691352885
SHA25615c4f223a3c1ecafb8c7b0af7036895c951eef5eafc797b2f14d78f97617130e
SHA5121a6e11f75248194239568afbe21aa29ac66e63ffc1c2ed971e9e6daefe33e98fb79f1ba057b9efdd1fdac510f8df42fef67a533f1e460100e5fc70d5d56027f3
-
Filesize
8KB
MD5897e2dcc8d2e29b0727b797f05e74629
SHA1f9817d6a449e3653d3e69e5f6a21e16d0476d2fd
SHA2566e4a38087f2885e686979fdcf87da0cef7a58bd578fbe797df5d17a0ccdfc124
SHA512486d5a2aaf58c9401f34e7a0978c989e4dd2573bc0b58b2c926fb17cbf5f9cd611cec00d352d964af01ff8d4d036fdf2a00750d66b3806f568a055b3aaf33f9b
-
/data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/com.crashlytics.settings.json
Filesize715B
MD54b9c95180b451467f231bb255eb5fdad
SHA11f5952ee6bddb10c83de4941d719ae4cb069d0d4
SHA2562122299c584a60ac2a5b675b9f7c65134d63425313f182846d658c0226d57e43
SHA512a961be60ffa8f203b48505990bc89b8cdd9480332883f11528fabf33daa57fc687621cd6b0dbe9291937f39cb936ed6767b414107c278d1da55d0f0f88714018
-
/data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/open-sessions/666A8EC700AF00011428AA09000C04CD/report
Filesize759B
MD51b9778177a75d7bc30de2eca86f1e519
SHA174e6d6a48193ebc74e825a9b8cc6c088b67ce745
SHA256c65f606c1bf832f220a19d88705c04cc83f8053f9c9c3c342fd3d3487226d2a9
SHA51200fe14bd71572cabd214fb616cfda9d4fd7b767a949629d53f7853f99fcf034daa4de1ebb0d72fa8ab8a28dd87038021c086e777edbce2f3e76f463946055a2e
-
/data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/open-sessions/666A8EC700AF00011428AA09000C04CD/userlog
Filesize198B
MD578a2fcd0bf3620788531b8893ce0fc1e
SHA134e14aebc8e297e460ef30c204926e099e9a0ca8
SHA256f718c92a7d95f6e5b98937c8dc72bdbd2836b6839fea744220ba76d15852f198
SHA5124042947ffc2475eabbc2fdab2a2cff26811f8f2ca554d1f7ca3a76052303cf375e2d6da6a0b4f2180752922c2f20d0ac1004be1cfa3ab1dada1e1bc0f045d51a
-
/data/data/cl.megamedia.megago/files/.com.google.firebase.crashlytics.files.v2:cl.megamedia.megago/open-sessions/666A8EC700AF00011428AA09000C04CD/userlog.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
Filesize
568B
MD57f91e41dc796aaad3711f78c9225664d
SHA1c459f25ae225fcf6bb69f81e4ede60f49795b3f4
SHA256c5a1e0f693c75caaffc8b7f891fa71c26dc588edd031f448613f9175b7a74a97
SHA5126b913990a5918f9346eb0d9ca12ab0b5cdd43be991d64a40230bb52657870caa6c85a63e1d8cc550206a5ee0822d52c9803b0a6d5140dca4b73ec325faae1b94
-
Filesize
90B
MD574649b89289df7c5c631fb3479f48911
SHA193c93ed03722674eaa882d548fcb2d94623ed714
SHA256d514119748e246b3bc7259130b62a6c347009f015287f817db87c2ffc7d91196
SHA51256e9c852c4b102e556f5a6c69a1d518a0de81336cb6553b7fe15822cf2fe30ee357663417e634e32ecb3cc9376c0d6fc85c4e9d0a622d4a28e138ee7661f6c77
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5e5203c81ffd9db01f73b0860c1f3f4d7
SHA10cb89e5b5c996add7ef3660450d8a1f2d10fe611
SHA25680d357111da58b550c9bd6aa57f461aa48e345d51fc7a01f2587faa95be9f1c4
SHA5121ea5c6a3c88ebfd11a05e720f17dca82fb5cce7666bff8d7daec909860a889d1a89d1d6f451b36dd2a2f0f6dfcffd6c306a3949be5548eaca78e8e1925678642
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD51bdf0c4d75d03fabee7104b29c51b665
SHA1895813b84b19bdef7ff89a7b3996f0062c58f803
SHA25625f35864af792135fbfffc56e81ebe1281cb1d99812b359ea5f3e44f8d794698
SHA512e1a8130c426e0619f8448a9f431e1f36638589508aa0bea1f08f519259a8ec0c147b0ededbbdc47a3ec6e5129eaaa739a3fb7a0a0ed5e732d458c62960fe016c
-
Filesize
112KB
MD5566de71adda95fdb7344caf9b22e1966
SHA1085131c42d911c6cd33f9d1e6893d263c2ca785b
SHA2561d54f8d42cfb1909aac97627b56674c7c3bd9af4fe59fe8c6e868f0348a58a58
SHA51223f6cb2b2334613dab5f6259d412cbdef8edccbd84b6086060300c825d32f9047bb799dd930d08cb019c2868358e118c77a95bf4d4b87e1f5fc96272cb257eb9
-
Filesize
120KB
MD59abcb64cbbafe34ef05e39012578b12f
SHA17ca42d0a7f111d1d664e12b5f94fd99751a2ec57
SHA256384de29d298ec8131fd9362f5dc7b58b2dcce62ba04aaf24a01a00bb2b7fe136
SHA5122509e0860569ae3c4805b9ba3e5e15e7f995077aeb75f3472e6f81bf34349a8e0f5d4e58de36c430c2abdea9a75b4c8ce0655344e466b77b63aeeb1695a99f19