8bfd3346b3da5814f82eff6f1b1b5fedd0ad585f39a25709b23eb54aac45691d

Analysis

max time kernel
2s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
23/01/2025, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Magisk-v28.1.apk
Size

11.2MB
MD5

ebe29762bb3ba4397462812ecf28ba0c
SHA1

c1611cf8276883622f5c2ede709113ffc7ec8227
SHA256

8bfd3346b3da5814f82eff6f1b1b5fedd0ad585f39a25709b23eb54aac45691d
SHA512

82ef2227f34315a60bdcbe1be10df6b5c2c76ff10b778760a2a53c1299cb2cb75c94f5c239ecfa9d0da3eabb738937db117a4ae55b1c7f74f93af236a1d83cd3
SSDEEP

196608:0GaYVcVS4OlQ4OB2oTn9ko7scmdA5ASw7liDOLANeHqghsH5Wt5Red+La06NSnzG:0GbwUzbokAscmgq66ANGqCMdLzAS

Score

4^/10

persistence

Malware Config

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.topjohnwu.magisk

com.topjohnwu.magisk
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4256
- su
  2⤵
  PID:4309

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.topjohnwu.magisk/files/profileInstalled

Filesize
24B

MD5
1b32846d1f18cc3e8c2f6b808c11a0f7

SHA1
67fdaba050389de2c726cc230267947a3609dae8

SHA256
2c6626fffe6519bb305c12a043dabcfc7aaf02cf162433c8335cca932ef3c740

SHA512
0c5fd67c5f2bff6fc81d047e119916bd20de4dd8880329116214f49be92702e8f45c85e06ce4caa0c49edf21c5dfa5ff9d9099e31de55778bdae08d8824940a5

Download Submit
/data/data/com.topjohnwu.magisk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
ca682d03175b9c2b18a335eafe85e912

SHA1
225f6903f48f2dd508bbd28c04f62c3b4472458f

SHA256
311d7344ec9fe00bd5e7a4aa801b4800b3c6d60a6e7d1a02bcb9e6e685aa9989

SHA512
00be06c729e030075ea1ad1a6c213425f97da825be4821236c8c7806f379b8839dd99ae2ad96cf1f79bb5a6242244e5bae12b2cea4e5246fd2bd9802061c4ff8

Download Submit
/data/misc/profiles/cur/0/com.topjohnwu.magisk/primary.prof

Filesize
3KB

MD5
12ade2275cbe887e0559d74347973235

SHA1
3bd792627b62ef615a7d339d684aa0d330714c10

SHA256
66e211c4a355c5f973622410f98d5b597c0271ada16ff9da20d7ee7ad30b09be

SHA512
a9feaaa0f8e51be69d538d6efd9ef16174313f61086d35eccdbf830965c833a5bf2e65a986ff57dbf76f9b04166a54a17dcf58607b258084427c3a54c6da741c

Download Submit
/data/user_de/0/com.topjohnwu.magisk/cache/main.jar

Filesize
3KB

MD5
51fc1652a346f9ade84aabfb44fa8853

SHA1
4c4da2058dec4b5457c109f5e807592a75b19a29

SHA256
ae7fdb8b70bd2c1cc2c27043e985f8dc5cfff2cb9142a1576dcdbc889763ef7b

SHA512
2b79aec9dbe7f1a1db081c8bfb35784de44d6c394fb9f19f47f5053d6210eed34ba920dface04cc12502fd6cb44449518be389cd04cd5417f4548ffe0ba89af3

Download Submit