Analysis
-
max time kernel
576s -
max time network
603s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
26/01/2025, 18:57 UTC
General
-
Target
https://www.mediafire.com/file/nudqui5lxmksqa7/Lyricify_1.4.3_by_xiaomicustom.apk/file
Score
1/10
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.android.chrome1⤵
- Checks CPU information
- Checks memory information
Network
-
DNSaccounts.google.comRemote address:1.1.1.1:53Requestaccounts.google.comIN AResponseaccounts.google.comIN A74.125.133.84 -
DNSwww.mediafire.comRemote address:1.1.1.1:53Requestwww.mediafire.comIN AResponsewww.mediafire.comIN A104.17.150.117www.mediafire.comIN A104.17.151.117
-
DNSthe.gatekeeperconsent.comRemote address:1.1.1.1:53Requestthe.gatekeeperconsent.comIN AResponsethe.gatekeeperconsent.comIN A104.21.42.32the.gatekeeperconsent.comIN A172.67.199.186
-
DNSstatic.mediafire.comRemote address:1.1.1.1:53Requeststatic.mediafire.comIN AResponsestatic.mediafire.comIN A104.17.150.117static.mediafire.comIN A104.17.151.117
-
DNSstatic.cloudflareinsights.comRemote address:1.1.1.1:53Requeststatic.cloudflareinsights.comIN AResponsestatic.cloudflareinsights.comIN A104.16.80.73static.cloudflareinsights.comIN A104.16.79.73
-
DNSprivacy.gatekeeperconsent.comRemote address:1.1.1.1:53Requestprivacy.gatekeeperconsent.comIN AResponseprivacy.gatekeeperconsent.comIN A104.21.42.32privacy.gatekeeperconsent.comIN A172.67.199.186
-
DNScdn.amplitude.comRemote address:1.1.1.1:53Requestcdn.amplitude.comIN AResponsecdn.amplitude.comIN A18.154.84.124cdn.amplitude.comIN A18.154.84.60cdn.amplitude.comIN A18.154.84.20cdn.amplitude.comIN A18.154.84.84
-
DNSsandbox.mediafire.comRemote address:1.1.1.1:53Requestsandbox.mediafire.comIN AResponsesandbox.mediafire.comIN A104.17.151.117sandbox.mediafire.comIN A104.17.150.117
-
DNSssl.google-analytics.comRemote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A142.250.200.8
-
DNSclients1.google.comRemote address:1.1.1.1:53Requestclients1.google.comIN AResponseclients1.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.200.14
-
DNSapi.amplitude.comRemote address:1.1.1.1:53Requestapi.amplitude.comIN AResponseapi.amplitude.comIN A44.236.228.226api.amplitude.comIN A44.225.234.85api.amplitude.comIN A52.38.179.198api.amplitude.comIN A52.26.141.115api.amplitude.comIN A34.218.178.30api.amplitude.comIN A52.25.4.214api.amplitude.comIN A52.33.171.48api.amplitude.comIN A34.218.105.82
-
DNSregion1.analytics.google.comRemote address:1.1.1.1:53Requestregion1.analytics.google.comIN AResponseregion1.analytics.google.comIN A216.239.32.36region1.analytics.google.comIN A216.239.34.36
-
DNSstats.g.doubleclick.netRemote address:1.1.1.1:53Requeststats.g.doubleclick.netIN AResponsestats.g.doubleclick.netIN A64.233.167.155stats.g.doubleclick.netIN A64.233.167.156stats.g.doubleclick.netIN A64.233.167.154stats.g.doubleclick.netIN A64.233.167.157
-
DNSwww.google.co.ukRemote address:1.1.1.1:53Requestwww.google.co.ukIN A
-
DNSwww.google.co.ukRemote address:1.1.1.1:53Requestwww.google.co.ukIN AResponsewww.google.co.ukIN A172.217.16.227
-
DNSupdate.googleapis.comRemote address:1.1.1.1:53Requestupdate.googleapis.comIN AResponseupdate.googleapis.comIN A172.217.169.67
-
POSThttps://update.googleapis.com/service/update2Remote address:172.217.169.67:443RequestPOST /service/update2 HTTP/1.1
Content-Length: 657
Content-Type: application/x-www-form-urlencoded
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; Pixel 2 Build/QSR1.210802.001)
Host: update.googleapis.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Sun, 26 Jan 2025 18:57:54 GMT
Content-Type: text/xml; charset=UTF-8
X-Daynum: 6600
X-Daystart: 39474
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
DNSandroid.apis.google.comRemote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A142.250.187.206
-
DNSupdate.googleapis.comRemote address:1.1.1.1:53Requestupdate.googleapis.comIN AResponseupdate.googleapis.comIN A142.250.180.3
-
74.125.133.84:443accounts.google.comtls -
104.17.150.117:443www.mediafire.comtls -
104.17.150.117:443www.mediafire.comtls
-
104.21.42.32:443the.gatekeeperconsent.comtls
-
104.16.80.73:443static.cloudflareinsights.comtls
-
104.21.42.32:443privacy.gatekeeperconsent.comtls
-
18.154.84.124:443cdn.amplitude.comtls
-
142.250.200.8:443ssl.google-analytics.comtls
-
142.250.200.14:443clients1.google.comtls
-
44.236.228.226:443api.amplitude.comtls
-
216.239.32.36:443region1.analytics.google.comtls
-
64.233.167.155:443stats.g.doubleclick.nettls
-
172.217.16.227:443www.google.co.uktls
-
172.217.169.67:443https://update.googleapis.com/service/update2tls, http
HTTP Request
POST https://update.googleapis.com/service/update2HTTP Response
200 -
142.250.180.14:443tls, https
-
142.250.187.206:443android.apis.google.comtls
-
172.217.16.228:443tls, https
-
172.217.16.228:443www.google.comtls
-
216.58.213.10:443tls, https
-
142.250.200.34:443tls
-
216.58.201.99:443tls, https
-
216.58.201.99:443tls, https
-
216.58.201.99:443tls, https
-
142.250.180.3:443update.googleapis.comtls
-
142.250.179.238:443
-
224.0.0.251:5353 -
1.1.1.1:53accounts.google.comdns
DNS Request
accounts.google.com
DNS Response
74.125.133.84
-
1.1.1.1:53www.mediafire.comdns
DNS Request
www.mediafire.com
DNS Response
104.17.150.117104.17.151.117
-
1.1.1.1:53the.gatekeeperconsent.comdns
DNS Request
the.gatekeeperconsent.com
DNS Response
104.21.42.32172.67.199.186
-
1.1.1.1:53static.mediafire.comdns
DNS Request
static.mediafire.com
DNS Response
104.17.150.117104.17.151.117
-
1.1.1.1:53static.cloudflareinsights.comdns
DNS Request
static.cloudflareinsights.com
DNS Response
104.16.80.73104.16.79.73
-
1.1.1.1:53privacy.gatekeeperconsent.comdns
DNS Request
privacy.gatekeeperconsent.com
DNS Response
104.21.42.32172.67.199.186
-
1.1.1.1:53cdn.amplitude.comdns
DNS Request
cdn.amplitude.com
DNS Response
18.154.84.12418.154.84.6018.154.84.2018.154.84.84
-
1.1.1.1:53sandbox.mediafire.comdns
DNS Request
sandbox.mediafire.com
DNS Response
104.17.151.117104.17.150.117
-
1.1.1.1:53ssl.google-analytics.comdns
DNS Request
ssl.google-analytics.com
DNS Response
142.250.200.8
-
1.1.1.1:53clients1.google.comdns
DNS Request
clients1.google.com
DNS Response
142.250.200.14
-
1.1.1.1:53api.amplitude.comdns
DNS Request
api.amplitude.com
DNS Response
44.236.228.22644.225.234.8552.38.179.19852.26.141.11534.218.178.3052.25.4.21452.33.171.4834.218.105.82
-
1.1.1.1:53region1.analytics.google.comdns
DNS Request
region1.analytics.google.com
DNS Response
216.239.32.36216.239.34.36
-
1.1.1.1:53stats.g.doubleclick.netdns
DNS Request
stats.g.doubleclick.net
DNS Response
64.233.167.15564.233.167.15664.233.167.15464.233.167.157
-
1.1.1.1:53www.google.co.ukdns
DNS Request
www.google.co.uk
-
1.1.1.1:53www.google.co.ukdns
DNS Request
www.google.co.uk
DNS Response
172.217.16.227
-
1.1.1.1:53update.googleapis.comdns
DNS Request
update.googleapis.com
DNS Response
172.217.169.67
-
1.1.1.1:53android.apis.google.comdns
DNS Request
android.apis.google.com
DNS Response
142.250.187.206
-
1.1.1.1:53update.googleapis.comdns
DNS Request
update.googleapis.com
DNS Response
142.250.180.3
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241KB
MD574abaeae7bc13dbff509106fdcbc4cdb
SHA1f7a44579539425ef1d5ffd1dcc286799ef9dfe84
SHA256e1d7f39692b1c4867f496e8faf1de9437dcd8934ac591aaf0bcb011b71b3635a
SHA512462c5fca642dd44412f3575aa14d68123921339deeee56f68ad5fdd92e4547ab0047cc09d6f1798465b265efe284f93ca91942193c4a83af8306067df54d05bb