Analysis
-
max time kernel
66s -
max time network
1236s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
25/08/2024, 07:00 UTC
Static task
static1
Behavioral task
behavioral1
Sample
magis_mobile_v6.5.2.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
magis_mobile_v6.5.2.apk
Resource
android-x64-20240624-en
General
-
Target
magis_mobile_v6.5.2.apk
-
Size
48.9MB
-
MD5
c4614c08c3be4ee9972870056d47afae
-
SHA1
e68156b531ffaade1090b7326b7ae7d604975cd0
-
SHA256
ebf7e2064d5ea30c141dd52673f33074a5a35c6bda161f9406e0b5b31afa6d22
-
SHA512
237381bcf0b3485a8f9cb0f5d4d018ea92c2c8d772db59676b1d6450fa58825309f00c2925922b3c7b240656bc7a086809ebc32ac8b548f29490e2e5b3df0e5c
-
SSDEEP
1572864:7rohglXys6OPl2eH4j6C9jitpKjlqCCjs2M:Howys6OPA2CAzKpJCja
Malware Config
Signatures
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
description ioc Process Accessed system property key: ro.product.model com.android.mgandroid -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.android.mgandroid/Anonymous-DexFile@3486835877.jar 5063 com.android.mgandroid /data/user/0/com.android.mgandroid/Anonymous-DexFile@1977697904.jar 5063 com.android.mgandroid /data/user/0/com.android.mgandroid/Anonymous-DexFile@2211334647.jar 5063 com.android.mgandroid
Processes
Network
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A142.250.200.40
-
Remote address:1.1.1.1:53Requesttime.nist.govIN AAAAResponsetime.nist.govIN CNAMEntp1.glb.nist.govntp1.glb.nist.govIN AAAA2610:20:6f15:15::26
-
Remote address:1.1.1.1:53Requesttime.cloudflare.comIN AAAAResponsetime.cloudflare.comIN AAAA2606:4700:f1::1time.cloudflare.comIN AAAA2606:4700:f1::123
-
Remote address:1.1.1.1:53Requesttime.nist.govIN AResponsetime.nist.govIN CNAMEntp1.glb.nist.govntp1.glb.nist.govIN A132.163.96.1
-
Remote address:1.1.1.1:53Requesttime.apple.comIN AAAAResponsetime.apple.comIN CNAMEtime.g.aaplimg.comtime.g.aaplimg.comIN AAAA2a01:b740:a20:3000::1f2time.g.aaplimg.comIN AAAA2a01:b740:a16:3000::1e2time.g.aaplimg.comIN AAAA2a01:b740:a16:4000::1f2
-
Remote address:1.1.1.1:53Requestpool.ntp.orgIN AAAAResponse
-
Remote address:1.1.1.1:53Requesttime.cloudflare.comIN AResponsetime.cloudflare.comIN A162.159.200.1time.cloudflare.comIN A162.159.200.123
-
Remote address:1.1.1.1:53Requesttime.apple.comIN AResponsetime.apple.comIN CNAMEtime.g.aaplimg.comtime.g.aaplimg.comIN A17.253.28.125time.g.aaplimg.comIN A17.253.108.125time.g.aaplimg.comIN A17.253.28.123
-
Remote address:1.1.1.1:53Requestpool.ntp.orgIN AResponsepool.ntp.orgIN A162.159.200.1pool.ntp.orgIN A85.199.214.98pool.ntp.orgIN A80.87.128.222pool.ntp.orgIN A139.162.219.252
-
Remote address:20.70.246.20:80RequestGET / HTTP/1.1
Host: microsoft.com
User-Agent: AppleCoreMedia/1.0.0.18F72 (iPhone; U; CPU OS 14_6 like Mac OS X; en_us)
ResponseHTTP/1.1 301 Moved Permanently
Date: Sun, 25 Aug 2024 07:04:29 GMT
Server: Kestrel
Location: https://www.microsoft.com/
Strict-Transport-Security: max-age=31536000
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.180.14
-
Remote address:1.1.1.1:53Requestsemanticlocation-pa.googleapis.comIN AResponsesemanticlocation-pa.googleapis.comIN A216.58.212.234semanticlocation-pa.googleapis.comIN A142.250.180.10semanticlocation-pa.googleapis.comIN A172.217.169.10semanticlocation-pa.googleapis.comIN A142.250.179.234semanticlocation-pa.googleapis.comIN A142.250.187.202semanticlocation-pa.googleapis.comIN A142.250.200.42semanticlocation-pa.googleapis.comIN A172.217.169.74semanticlocation-pa.googleapis.comIN A216.58.212.202semanticlocation-pa.googleapis.comIN A142.250.178.10semanticlocation-pa.googleapis.comIN A172.217.16.234semanticlocation-pa.googleapis.comIN A142.250.187.234semanticlocation-pa.googleapis.comIN A172.217.169.42semanticlocation-pa.googleapis.comIN A216.58.201.106semanticlocation-pa.googleapis.comIN A142.250.200.10semanticlocation-pa.googleapis.comIN A216.58.204.74
-
Remote address:1.1.1.1:53Requestsemanticlocation-pa.googleapis.comIN AResponsesemanticlocation-pa.googleapis.comIN A172.217.169.10semanticlocation-pa.googleapis.comIN A216.58.212.202semanticlocation-pa.googleapis.comIN A172.217.16.234semanticlocation-pa.googleapis.comIN A216.58.213.10semanticlocation-pa.googleapis.comIN A142.250.187.234semanticlocation-pa.googleapis.comIN A142.250.178.10semanticlocation-pa.googleapis.comIN A216.58.212.234semanticlocation-pa.googleapis.comIN A142.250.180.10semanticlocation-pa.googleapis.comIN A172.217.169.74semanticlocation-pa.googleapis.comIN A142.250.200.10semanticlocation-pa.googleapis.comIN A142.250.179.234semanticlocation-pa.googleapis.comIN A142.250.200.42semanticlocation-pa.googleapis.comIN A216.58.204.74semanticlocation-pa.googleapis.comIN A172.217.169.42semanticlocation-pa.googleapis.comIN A216.58.201.106semanticlocation-pa.googleapis.comIN A142.250.187.202
-
Remote address:1.1.1.1:53Requestpool.ntp.orgIN AAAAResponse
-
Remote address:1.1.1.1:53Requesttime.apple.comIN AAAAResponsetime.apple.comIN CNAMEtime.g.aaplimg.comtime.g.aaplimg.comIN AAAA2a01:b740:a16:4000::1e2time.g.aaplimg.comIN AAAA2a01:b740:a16:3000::1f2time.g.aaplimg.comIN AAAA2a01:b740:a20:3000::1f2
-
Remote address:1.1.1.1:53Requesttime.nist.govIN AAAAResponsetime.nist.govIN CNAMEntp1.glb.nist.govntp1.glb.nist.govIN AAAA2610:20:6f96:96::4
-
Remote address:1.1.1.1:53Requestpool.ntp.orgIN AResponsepool.ntp.orgIN A131.111.8.60pool.ntp.orgIN A185.103.117.60pool.ntp.orgIN A95.215.175.2pool.ntp.orgIN A162.159.200.1
-
Remote address:1.1.1.1:53Requesttime.nist.govIN AResponsetime.nist.govIN CNAMEntp1.glb.nist.govntp1.glb.nist.govIN A132.163.96.2
-
Remote address:1.1.1.1:53Requesttime.cloudflare.comIN AAAAResponsetime.cloudflare.comIN AAAA2606:4700:f1::1time.cloudflare.comIN AAAA2606:4700:f1::123
-
Remote address:1.1.1.1:53Requesttime.cloudflare.comIN AResponsetime.cloudflare.comIN A162.159.200.1time.cloudflare.comIN A162.159.200.123
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.179.238
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A172.217.16.238
-
1.5kB 6.0kB 12 12
-
994 B 4.7kB 12 10
-
1.1kB 1.2kB 18 16
HTTP Request
GET http://microsoft.com/HTTP Response
301 -
925 B 5.1kB 10 7
-
5.7kB 8.5kB 39 40
-
1.0kB 3.4kB 13 10
-
928 B 5.1kB 10 7
-
48.9kB 40.2kB 195 183
-
857 B 40 B 1 1
-
7.3kB 10.3kB 33 33
-
429 B 40 B 2 1
-
9.4kB 10.6kB 32 37
-
2.0kB 6.2kB 15 15
-
128 B 40 B 2 1
-
135 B 40 B 2 1
-
256 B 40 B 4 1
-
128 B 40 B 2 1
-
520 B 10
-
520 B 10
-
2.0kB 5.9kB 11 12
-
1.9kB 5.8kB 8 9
-
3.7kB 11
-
70 B 86 B 1 1
DNS Request
ssl.google-analytics.com
DNS Response
142.250.200.40
-
59 B 110 B 1 1
DNS Request
time.nist.gov
DNS Response
2610:20:6f15:15::26
-
65 B 121 B 1 1
DNS Request
time.cloudflare.com
DNS Response
2606:4700:f1::12606:4700:f1::123
-
59 B 98 B 1 1
DNS Request
time.nist.gov
DNS Response
132.163.96.1
-
60 B 173 B 1 1
DNS Request
time.apple.com
DNS Response
2a01:b740:a20:3000::1f22a01:b740:a16:3000::1e22a01:b740:a16:4000::1f2
-
58 B 113 B 1 1
DNS Request
pool.ntp.org
-
65 B 97 B 1 1
DNS Request
time.cloudflare.com
DNS Response
162.159.200.1162.159.200.123
-
60 B 137 B 1 1
DNS Request
time.apple.com
DNS Response
17.253.28.12517.253.108.12517.253.28.123
-
58 B 122 B 1 1
DNS Request
pool.ntp.org
DNS Response
162.159.200.185.199.214.9880.87.128.222139.162.219.252
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
142.250.180.14
-
80 B 320 B 1 1
DNS Request
semanticlocation-pa.googleapis.com
DNS Response
216.58.212.234142.250.180.10172.217.169.10142.250.179.234142.250.187.202142.250.200.42172.217.169.74216.58.212.202142.250.178.10172.217.16.234142.250.187.234172.217.169.42216.58.201.106142.250.200.10216.58.204.74
-
80 B 336 B 1 1
DNS Request
semanticlocation-pa.googleapis.com
DNS Response
172.217.169.10216.58.212.202172.217.16.234216.58.213.10142.250.187.234142.250.178.10216.58.212.234142.250.180.10172.217.169.74142.250.200.10142.250.179.234142.250.200.42216.58.204.74172.217.169.42216.58.201.106142.250.187.202
-
58 B 113 B 1 1
DNS Request
pool.ntp.org
-
60 B 173 B 1 1
DNS Request
time.apple.com
DNS Response
2a01:b740:a16:4000::1e22a01:b740:a16:3000::1f22a01:b740:a20:3000::1f2
-
59 B 110 B 1 1
DNS Request
time.nist.gov
DNS Response
2610:20:6f96:96::4
-
58 B 122 B 1 1
DNS Request
pool.ntp.org
DNS Response
131.111.8.60185.103.117.6095.215.175.2162.159.200.1
-
59 B 98 B 1 1
DNS Request
time.nist.gov
DNS Response
132.163.96.2
-
65 B 121 B 1 1
DNS Request
time.cloudflare.com
DNS Response
2606:4700:f1::12606:4700:f1::123
-
65 B 97 B 1 1
DNS Request
time.cloudflare.com
DNS Response
162.159.200.1162.159.200.123
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
142.250.179.238
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
172.217.16.238
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.3MB
MD54f8d901f2116e28367570376189ceff9
SHA1d0223df1c963d3590f99064544975704b6bdbc59
SHA256cd1572bd1969374ecd2140b3c4aba2c1ad2c9d54536b67a83822c70ac5013332
SHA512463b175bf7d724c6ea2ccfbe8daf5e15ff155657c595d19b3344a7cd8e4926332a8d7700f488f6400468567f264fc63f77a4af714c3c97480c495218b4a24a08
-
Filesize
522KB
MD57636300c06bce717fd788f2fe6feef39
SHA1cea7ec57f85331d548485c928b06bb8013c5fba1
SHA256b0ab74c381526f282bcafc664b0125a0e34d7fd081200c1b19d649f34ea66546
SHA5123e80a3927b148202e885cc30c8314afd4aae8953a6825c08d813c555a144125ab8a036f591b027c82c438d4b888e770d96200516b9eac61913d05967598d1144
-
Filesize
9KB
MD5217462abc75e03bb4812617378c03aa2
SHA1259cc7db714fc592f521062c21146a1618d92a13
SHA256c5646139fbbff362faefa378dfb204607fcf0c8c490d36c88d53395d16d1f5d6
SHA512b12b703e15bf2374a43d1273ee0431b26782dd970810dda55fab724968de518aa0eb5320b5e391a1f6e47d4e520d1aaebcf20784a6f6a1934bb84a66cacffc48
-
Filesize
446KB
MD572b29ca122fa57c30ff2aaf6fcaaf191
SHA1285dca283cea43f908c6cda623d036c82dbbac25
SHA2560e494c2a848447b9f308c89dcf1d56c85b115c189d6475fa99e4ca207e413dbb
SHA5123b0db1ebbaeda870a8c7ba1201f140e8bb91c45068009523b1470173faca94ac60d6fb4ea895e9f04df265df8048e5e5a7d60cf52aa206e5d5269d237a1274b2
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5088f1e7be9fd4fb1b6f9fb1876256c45
SHA12babf0de1eec3134d856d669c1e966d0bfed99c0
SHA256191c1910c112bc0311e2f623518a751320db3654a40b828858c4b3da3d681939
SHA512a6d9abd399f579622c403b29950666c8994aea4b8d926555027175e49790637d390fb9d615d5b948035089216fb36f5217d08c627152497fe9e79ba24d1cd56c
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
112KB
MD5e6c5a81e4dbfd84f1b0e6981c6e6fb08
SHA1654e139ba51830d12d17de4947ef87efbebd1fa5
SHA25624d88b4aeee5dd7b99e60b612949fa2cd779029f2a433734270a7e5b3c0f95d5
SHA5129da7f21d27c1963077382cad57a2915c490c1ff15503e035ef1992200b228131c89e6ec90a7c9086b5e6668eae5adb03f18a737a8c96b4e2ba7c372df48d595c
-
Filesize
120KB
MD566015a63ef26ad56f3cebc23c571aecc
SHA1d69ba16f46a3fc5acdee936ebd171dda93a271e1
SHA2569dbe17ea462d94d11989fd5e40874d4109d5a05d5d41d56cb0ea6681c8f91af7
SHA512b36aeb76ae34674c4ae435c53f60eff438b15ad291cf128025ef08b892b96cd0f87e9a910cceacf8ed677d0d1b45ff38a3a2adb3993b0c543303c81c92e10fd0
-
Filesize
16KB
MD59881b0415a402918783c89f2e75b83d5
SHA1674ca92fa43112af24c0d3d9820297ebbb7bb37f
SHA256c4c6dccaf7667a918621d443730d32850f7d4eb10f37754b7de566e941f24377
SHA5124b2318b56971a64a9a104f528b78e4be9e3b53f034ea6ded12df24009ee8534b88b5be59ffdc343bcd371f6ae1f04fbd3607078d3f8497bebf224710f24bac18
-
Filesize
4.1MB
MD52da326fffd51c260a43e8e44dc6ef615
SHA17512a70c523416c6dcd2d03e5c992d6b516b0014
SHA256459b1273f8837812863e1b5c49affea4fcb7d24c6f329b9d0e99f5fdcd8559c8
SHA512f604f6b3e6aeab5ba73cabc8e723deddfbfbb2cc4e47446bf53651c154f0fd337b95f73a2724dc361863e1c57268b409770395c0ae0044266facd3da075dc532
-
Filesize
82KB
MD591cfcd0ce94aa4bdd5e4c72e248adc44
SHA17f2cc2cd1d4e49796a3dc81fc0d7570a754f97ee
SHA2565c04eacf40f5430781951166732aac9d6c595b2f4c1e1990be4b3dcdf1099d8a
SHA5122e1921a7d40b93065cc1f65b38eb7b307248eb2d7b075d5cde1ac3876a4700a676f3620960a7a0ae7f09515f86e93043034c2803647b347675cc91e9b909a25f
-
Filesize
8.2MB
MD5bfb56ae2be41feb809ba8e196de52394
SHA146533611df95ab99936c60ce788c535e10562f1d
SHA25642207e028872dd4e282232a8474fd4dedaddf996077f6da57f6a9d68b299ae1f
SHA5123a9efd4cebb68c221641e031b5e24d33aaca41c7242521a0d758eb09214f96be92dbab60cc1f849fb20a7fb34f7b7c75078194b8dd79f1b59acbb233df2f0a36