Analysis Overview
SHA256
f511bd33d3242911d05b0939f910a3133ef2ba0e0ff1e098128f9f3cd0c16610
Threat Level: Known bad
The file f511bd33d3242911d05b0939f910a3133ef2ba0e0ff1e098128f9f3cd0c16610 was found to be: Known bad.
Malicious Activity Summary
Antidot family
Antidot payload
Loads dropped Dex/Jar
Queries information about active data network
Requests dangerous framework permissions
Registers a broadcast receiver at runtime (usually for listening for system events)
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-07-11 07:39
Signatures
Antidot family
Antidot payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES | N/A | N/A |
| Allows an app to post notifications. | android.permission.POST_NOTIFICATIONS | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral6
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:42
Platform
android-x86-arm-20240624-en
Max time kernel
7s
Max time network
138s
Command Line
Signatures
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES | N/A | N/A |
| Allows an app to post notifications. | android.permission.POST_NOTIFICATIONS | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
Processes
com.topjohnwu.magisk
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.213.10:443 | tcp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| GB | 142.250.200.46:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.14:443 | android.apis.google.com | tcp |
Files
/data/data/com.topjohnwu.magisk/code_cache/res.apk
| MD5 | 4ce31e6d5268f943dc49d07cbd4ea65e |
| SHA1 | a2b733bbf9cce325db227e4c6bfb02a262bc1122 |
| SHA256 | d6072045ed67e0221e45728731a2420b4143419e05a8ab0777748f587421ac57 |
| SHA512 | 50e9d5232639cbcb4c9a3651beb71aca181eef2daedab00878fdf035c82c2764656091a63ed1d24fd5d515366131aa10844ad488d9470ea79126daa0fc153e21 |
Analysis: behavioral8
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:42
Platform
android-x64-arm64-20240624-en
Max time kernel
7s
Max time network
134s
Command Line
Signatures
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Processes
com.topjohnwu.magisk
Network
| Country | Destination | Domain | Proto |
| GB | 216.58.212.238:443 | tcp | |
| GB | 216.58.212.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.180.14:443 | android.apis.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.180.8:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.187.228:443 | tcp | |
| GB | 142.250.187.228:443 | tcp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:42
Platform
android-x86-arm-20240624-en
Max time kernel
7s
Max time network
133s
Command Line
Signatures
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Processes
com.topjohnwu.magisk
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.200.10:443 | tcp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| GB | 142.250.200.46:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.14:443 | android.apis.google.com | tcp |
Files
/data/misc/profiles/cur/0/com.topjohnwu.magisk/primary.prof
| MD5 | 1a6b66bb28fd3cd838884f168b48ddcc |
| SHA1 | 902524d1db3ef9be7d5a42fa59a679ae9e342820 |
| SHA256 | c26a72bb48f7d06d6d16b660802a1af72615722f79bcfbd17af9a0d08ed50c65 |
| SHA512 | b11bc9814178970547255a99a3fbc51121e16871b4b717ad0066299d00f0eb6f7f9599ca5af7a759e0262c3d82c2f26ea4be6784fe8238ab880aec073176e41c |
/data/data/com.topjohnwu.magisk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
| MD5 | 83e96f088bcce72189facff131e27a89 |
| SHA1 | bee4d2c7bc08e79b50457e6f00bae6e250184ae8 |
| SHA256 | fd42e1d778dc1b2f646e42440e1095e3f55db78fd9e9ccb1700764b529db5a9e |
| SHA512 | 66dbe227ae59d11e5abba1128b53163e0375442900c9ef1508bcac8064e7b3c74e711587ea66c45d851c2b07cae9bac3beffc2b891663f35d071dfe8dd202a64 |
/data/data/com.topjohnwu.magisk/files/profileInstalled
| MD5 | e4fc24d37c4e2e3e9a43b48cf4452ac2 |
| SHA1 | 249d3d9f964fe1f94490c742c66940a33acff17f |
| SHA256 | 29218e0b233e87e892789730ade815a2a1132573057d30f189f47a97e58f5018 |
| SHA512 | c5cc7fd7bb7c2375c265241523a83c19e1a3be85a2048408bb476fcd73368dde2b5e2d074e70ec62efe67a3f6870b4307ca716f9db939293198b94ec794ee295 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:42
Platform
android-x64-arm64-20240624-en
Max time kernel
2s
Max time network
131s
Command Line
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /system_ext/framework/androidx.window.sidecar.jar | N/A | N/A |
| N/A | /system_ext/framework/androidx.window.sidecar.jar | N/A | N/A |
Processes
com.topjohnwu.magisk
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.206:443 | tcp | |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.204.78:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 216.58.201.104:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.187.228:443 | tcp | |
| GB | 142.250.187.228:443 | tcp |
Files
/system_ext/framework/androidx.window.sidecar.jar
| MD5 | bdf3529e80318eb14e53a5bf3720c10d |
| SHA1 | 25c9ace4b1af6e80ebb2572345972c56505969ba |
| SHA256 | bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b |
| SHA512 | 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b |
/data/misc/profiles/cur/0/com.topjohnwu.magisk/primary.prof
| MD5 | 1a6b66bb28fd3cd838884f168b48ddcc |
| SHA1 | 902524d1db3ef9be7d5a42fa59a679ae9e342820 |
| SHA256 | c26a72bb48f7d06d6d16b660802a1af72615722f79bcfbd17af9a0d08ed50c65 |
| SHA512 | b11bc9814178970547255a99a3fbc51121e16871b4b717ad0066299d00f0eb6f7f9599ca5af7a759e0262c3d82c2f26ea4be6784fe8238ab880aec073176e41c |
/data/data/com.topjohnwu.magisk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
| MD5 | 4a1668145ea5b3c1a9d0841132574be4 |
| SHA1 | 5403efc304c777a8fe96479b3884bd52f29bdfd9 |
| SHA256 | cef42cb65bbef4cb17c585ba6ac5b86c019ace833eb6d23fa31675dedd4a2881 |
| SHA512 | 53f5bf0031ce921607bbf9a2cbce2e450269d7df62a59082aca984a3ed8947f4a452cd97ca598f9cbcaf690e9b8a330b96ff77226c9f509035ec7f0a3fe65b35 |
/data/user_de/0/com.topjohnwu.magisk/cache/main.jar
| MD5 | 803d520477442e45318b1b0fc76c6c15 |
| SHA1 | 68e0102a3a91f7a050cda807889b3ffa0e25ba18 |
| SHA256 | 4efaf47682fe8bf49c1aaa9ee7b907ced7246277ca996086da2284324fc8a9ab |
| SHA512 | 2523395f82258842bce3edd4033af92c0b1e10d664ad8817f6622b9ea701851ca0ba03bb2c06b9bc956f5e8ee988eacd41e9042e5873045449dabe78d6dcd913 |
Analysis: behavioral5
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:39
Platform
android-x64-arm64-20240624-en
Max time network
8s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:39
Platform
android-x86-arm-20240624-en
Command Line
Signatures
Processes
Network
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:39
Platform
android-x64-20240624-en
Max time network
7s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp |
Files
Analysis: behavioral7
Detonation Overview
Submitted
2024-07-11 07:39
Reported
2024-07-11 07:42
Platform
android-x64-20240624-en
Max time kernel
7s
Max time network
151s
Command Line
Signatures
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES | N/A | N/A |
| Allows an app to post notifications. | android.permission.POST_NOTIFICATIONS | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
Processes
com.topjohnwu.magisk
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.200.40:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.200.46:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.180.14:443 | android.apis.google.com | tcp |
| GB | 142.250.187.228:443 | tcp | |
| GB | 142.250.187.228:443 | tcp | |
| GB | 216.58.213.14:443 | tcp | |
| GB | 142.250.178.2:443 | tcp |
Files
/data/data/com.topjohnwu.magisk/code_cache/res.apk
| MD5 | d47dbc6f4e77f8bb484d3e3ce59461c8 |
| SHA1 | 4facd015d0221ac7ac25d7d2aaf565e30e60e17a |
| SHA256 | 81b06985e61293fd12ba8d0d9bc68cd3b93ee74c0c4566f13cae693891dc8492 |
| SHA512 | ec3087fd18a66e78726af1c39a4139af9fa5065830002cd0ef382a6e1a309aa09f32b955e5f8bf1d83cf9c96296ce2671e7165595d9a98a4b9f647a14e17ed0a |