Malware Analysis Report

2024-09-09 16:19

Sample ID 240711-jg4xxaydnb
Target f511bd33d3242911d05b0939f910a3133ef2ba0e0ff1e098128f9f3cd0c16610
SHA256 f511bd33d3242911d05b0939f910a3133ef2ba0e0ff1e098128f9f3cd0c16610
Tags
discovery antidot persistence evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f511bd33d3242911d05b0939f910a3133ef2ba0e0ff1e098128f9f3cd0c16610

Threat Level: Known bad

The file f511bd33d3242911d05b0939f910a3133ef2ba0e0ff1e098128f9f3cd0c16610 was found to be: Known bad.

Malicious Activity Summary

discovery antidot persistence evasion

Antidot family

Antidot payload

Loads dropped Dex/Jar

Queries information about active data network

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-11 07:39

Signatures

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:42

Platform

android-x86-arm-20240624-en

Max time kernel

7s

Max time network

138s

Command Line

com.topjohnwu.magisk

Signatures

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A

Processes

com.topjohnwu.magisk

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp

Files

/data/data/com.topjohnwu.magisk/code_cache/res.apk

MD5 4ce31e6d5268f943dc49d07cbd4ea65e
SHA1 a2b733bbf9cce325db227e4c6bfb02a262bc1122
SHA256 d6072045ed67e0221e45728731a2420b4143419e05a8ab0777748f587421ac57
SHA512 50e9d5232639cbcb4c9a3651beb71aca181eef2daedab00878fdf035c82c2764656091a63ed1d24fd5d515366131aa10844ad488d9470ea79126daa0fc153e21

Analysis: behavioral8

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:42

Platform

android-x64-arm64-20240624-en

Max time kernel

7s

Max time network

134s

Command Line

com.topjohnwu.magisk

Signatures

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.topjohnwu.magisk

Network

Country Destination Domain Proto
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:42

Platform

android-x86-arm-20240624-en

Max time kernel

7s

Max time network

133s

Command Line

com.topjohnwu.magisk

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.topjohnwu.magisk

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp

Files

/data/misc/profiles/cur/0/com.topjohnwu.magisk/primary.prof

MD5 1a6b66bb28fd3cd838884f168b48ddcc
SHA1 902524d1db3ef9be7d5a42fa59a679ae9e342820
SHA256 c26a72bb48f7d06d6d16b660802a1af72615722f79bcfbd17af9a0d08ed50c65
SHA512 b11bc9814178970547255a99a3fbc51121e16871b4b717ad0066299d00f0eb6f7f9599ca5af7a759e0262c3d82c2f26ea4be6784fe8238ab880aec073176e41c

/data/data/com.topjohnwu.magisk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 83e96f088bcce72189facff131e27a89
SHA1 bee4d2c7bc08e79b50457e6f00bae6e250184ae8
SHA256 fd42e1d778dc1b2f646e42440e1095e3f55db78fd9e9ccb1700764b529db5a9e
SHA512 66dbe227ae59d11e5abba1128b53163e0375442900c9ef1508bcac8064e7b3c74e711587ea66c45d851c2b07cae9bac3beffc2b891663f35d071dfe8dd202a64

/data/data/com.topjohnwu.magisk/files/profileInstalled

MD5 e4fc24d37c4e2e3e9a43b48cf4452ac2
SHA1 249d3d9f964fe1f94490c742c66940a33acff17f
SHA256 29218e0b233e87e892789730ade815a2a1132573057d30f189f47a97e58f5018
SHA512 c5cc7fd7bb7c2375c265241523a83c19e1a3be85a2048408bb476fcd73368dde2b5e2d074e70ec62efe67a3f6870b4307ca716f9db939293198b94ec794ee295

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:42

Platform

android-x64-arm64-20240624-en

Max time kernel

2s

Max time network

131s

Command Line

com.topjohnwu.magisk

Signatures

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A

Processes

com.topjohnwu.magisk

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp

Files

/system_ext/framework/androidx.window.sidecar.jar

MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

/data/misc/profiles/cur/0/com.topjohnwu.magisk/primary.prof

MD5 1a6b66bb28fd3cd838884f168b48ddcc
SHA1 902524d1db3ef9be7d5a42fa59a679ae9e342820
SHA256 c26a72bb48f7d06d6d16b660802a1af72615722f79bcfbd17af9a0d08ed50c65
SHA512 b11bc9814178970547255a99a3fbc51121e16871b4b717ad0066299d00f0eb6f7f9599ca5af7a759e0262c3d82c2f26ea4be6784fe8238ab880aec073176e41c

/data/data/com.topjohnwu.magisk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 4a1668145ea5b3c1a9d0841132574be4
SHA1 5403efc304c777a8fe96479b3884bd52f29bdfd9
SHA256 cef42cb65bbef4cb17c585ba6ac5b86c019ace833eb6d23fa31675dedd4a2881
SHA512 53f5bf0031ce921607bbf9a2cbce2e450269d7df62a59082aca984a3ed8947f4a452cd97ca598f9cbcaf690e9b8a330b96ff77226c9f509035ec7f0a3fe65b35

/data/user_de/0/com.topjohnwu.magisk/cache/main.jar

MD5 803d520477442e45318b1b0fc76c6c15
SHA1 68e0102a3a91f7a050cda807889b3ffa0e25ba18
SHA256 4efaf47682fe8bf49c1aaa9ee7b907ced7246277ca996086da2284324fc8a9ab
SHA512 2523395f82258842bce3edd4033af92c0b1e10d664ad8817f6622b9ea701851ca0ba03bb2c06b9bc956f5e8ee988eacd41e9042e5873045449dabe78d6dcd913

Analysis: behavioral5

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:39

Platform

android-x64-arm64-20240624-en

Max time network

8s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:39

Platform

android-x86-arm-20240624-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:39

Platform

android-x64-20240624-en

Max time network

7s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-07-11 07:39

Reported

2024-07-11 07:42

Platform

android-x64-20240624-en

Max time kernel

7s

Max time network

151s

Command Line

com.topjohnwu.magisk

Signatures

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A

Processes

com.topjohnwu.magisk

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.200.40:443 ssl.google-analytics.com tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
GB 216.58.213.14:443 tcp
GB 142.250.178.2:443 tcp

Files

/data/data/com.topjohnwu.magisk/code_cache/res.apk

MD5 d47dbc6f4e77f8bb484d3e3ce59461c8
SHA1 4facd015d0221ac7ac25d7d2aaf565e30e60e17a
SHA256 81b06985e61293fd12ba8d0d9bc68cd3b93ee74c0c4566f13cae693891dc8492
SHA512 ec3087fd18a66e78726af1c39a4139af9fa5065830002cd0ef382a6e1a309aa09f32b955e5f8bf1d83cf9c96296ce2671e7165595d9a98a4b9f647a14e17ed0a