2c9c2f0e3faccfddd69b8259182d614c50ce226df7135b6870f746ad600944ca

Sharing

Copy URL Twitter E-mail

General

Target
mumu-magisk-1click-main.zip
Size 60.1MB
Sample260910-sgcyvsde34
SHA256 2c9c2f0e3faccfddd69b8259182d614c50ce226df7135b6870f746ad600944ca
MD5 3a63b4dadc74573d8e88f58f08989ca8
SHA1 e554ad42de310d2727d5ea91d6610e305703860f
SHA512 4a29765f202365b8645e3cc4cd190e5ed9ba01e9c13a87ff2ef383585efff3d9484a48c5675a0f6d27428d30eedd92ccc7c5c9a389fcbc39bfcd6b3a813c7735
SSDEEP 1572864:50rLKR7XvAS8qE8hjd5/By6bcPUzxvMbSHXPfrrMEj/UbbRTR:5K27XvASnEU3nNvMbSHX7/UbbR9
TLSH
T179D733592FB5F74143A9A446A32E0E73107BF51AA3A640974808F7F22FE35281EDCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  mumu-magisk-1click-main/.github/workflows/ci.yml
- Size 8KB
- SHA256 c5849e4efbba5fa61e09aeb7f55993cb6e3fe08ed24fb99480f19ecbe01d0d36
- MD5 c84de86ca3d691d833c6dd59138250cf
- SHA1 4815e440fa995260a9c6e0b591ecd11fd81f2946
- SHA512 00e36ec0975e95286d317849ef600a0bd51543727a43bce2cc580571f6a941964260b14998a99598522c5774dce652bfab6d3d0fb688ccfb0a40b84d4f861767
- SSDEEP 192:tV6ZdwZ2MjPlFqFzbTb6EQb6EDsZbRbzbCbCbKbtb19/Hg43Cx8brb6babH5qjdH:tV2wZFjPwbTb6vb6eAbRbzbCbCbKbtbW
- TLSH
  T14B026457A216C83B6BA7626F68CFE1306013F18B834459207AFF089C5FFA97195F4706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  mumu-magisk-1click-main/Kitsune.bat
- Size 1KB
- SHA256 3478fa36fc6d1d27ad2b701a8c25289c59167c1606eef75d143807af6c1034f7
- MD5 a6c4e952c6a9f8e3150bf3fa788a91f4
- SHA1 6552dd676a9ebead8571fa3739e94be8395a1945
- SHA512 088b8ba015a68db510843e5061ba5a84468d94aa81339d64f4e3a2b198a53dc1a116791e1dff3fd3206584e510f27c6c91406ad24d075e6baa029ae685316555
- TLSH
  T1133186331F0EDB5FCA6A405195B80283E76DE1D7170CD0DD66B1825AA65E485C9F81C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  mumu-magisk-1click-main/MuMuInstaller.exe
- Size 5.5MB
- SHA256 ca27f5ffe24dd12b91ab17060dfd7cb08427850d6292853526de5237b408f1ea
- MD5 d820f350968269e711f8ccc747ad398f
- SHA1 0b6c3fcfae30e71bdc13a88d6c182d3e338b031a
- SHA512 430c2db53ff13b9ef94006516cb4e9fa56a7d4e6ed05cd0503cfafa24341448ce92342db25b2611bfb3d26fda382ca7dc7fc384b525828bd2cd0cd36e1d2b670
- SSDEEP 98304:Me221urJKtGn7xlt3HbAndGaX6tJJQv2FKA75OpVclc02vDRZTEq:Z221u8mlHbKo3u0jc02vVZoq
- TLSH
  T10A4622272E2EF10FD0115AB6E1D73AE8075BBE25D1B34C614457268B2762CFB9A3D01B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  mumu-magisk-1click-main/MuMuInstaller_Global.exe
- Size 5.8MB
- SHA256 4e30c1e0a97f730266f5239c34be63d5327774b0085c4d8f865c85d7fdc3816a
- MD5 63d7274e3a2b37c4d873eccb37fd9449
- SHA1 7c6563abde9e6aaa3bf2e8eb3e41cedd1bd1dfad
- SHA512 0cb884684f4428259fb9f634abb951910c68decfdbab5c79b2c689a3d5d2daee998a0218b95a5bad3d7ea76f4166488213af05446a330deae0b66d63657054a4
- SSDEEP 98304:uer6uFFkOuPy3cjtFYEUO9u97ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJG:Xr6uFFkOuPT7c7ZHlLbjXLWjI+SvFCjG
- TLSH
  T1F3562392D601B3B2D41E5DFC512D87B6FE933CDE6D482C46018EF1ABB0AD5602E858DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  mumu-magisk-1click-main/RestoreMuMuConfig.bat
- Size 1KB
- SHA256 c2b07380d919b712dffbac9325fc42d8e65769dae99fee4c7f5020547a0b6eb6
- MD5 2b7c39794ea93963ace30d1d5c4402fe
- SHA1 71f4039e6041990055458f1d529b348cdb4d207a
- SHA512 6c2d009205b145d251b358e522bf3309db6dc4dcc7f1717ef3e325870ad9138ea35d1aa16f361298a4eb36ebba84d81c0ef32848aac72c02a98b7fbb16c7b937
- TLSH
  T10D2131232B0DA67B8B5B8052E0D80243E7BCD2D7230D95AAA5F6435C6B1E484C9F85D1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  mumu-magisk-1click-main/Setup.bat
- Size 1KB
- SHA256 db8dea061372eb2be391e07154f96a3e7c31b6635a24f5d705eb4b91d5f898ca
- MD5 dbc27f9b981fb0e622ebc46f057edf97
- SHA1 9ac26128f0d7cfb9cf97ba73ab758866af55aac5
- SHA512 be464510ec3d8ec353d4e2bffbd6c572eb21760973b0db1124dbaa312d135e9a9930a2783fb9c360d93c45abc9998a541db045666061598cb95f5a98d90b745d
- TLSH
  T1762131232B0EA67B8A5B4462D0D80243E7BCD297230D95AAA5F6035C6B0E485C8F85C1
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral11 behavioral12
- Target
  mumu-magisk-1click-main/Tools/HMA-OSS-oss-161-release.apk
- Size 3.0MB
- SHA256 059f9fa4a2ccdef83f281d9434c852d29a0728d5e0e4e0f1e13d96fade6947cd
- MD5 2007c3fa22d7927e108cdcadb635230e
- SHA1 680227b969959993a32ab925f90c1a37effd6a88
- SHA512 24da850cbdff1dec32aaea707892a2188441cdad2ba50963af95fc7232245345ff9b773b2a704ffe4ed789b6cc61414ecc8fc0faf161ef2d50f414d2d2bef5d5
- SSDEEP 49152:uo7WNU9R2+hYIqXeC1Kg/OVZ01Y66dmcp72CihPGOS7Z0191d30uJ:uoqm9VhYI29K1V+YPmckCiKZ0191d30g
- TLSH
  T13AE5AD9BB75C192BC4B7047ACD66B221970E5F0A4B439B937544732C28B32D85FB9BC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15
- Target
  lib/x86_64/libzygisk_ptrace.so
- Size 446KB
- SHA256 c0142ca5b29031860e243e21e7d9d2b01b9baa199ce70727a76132deaecbf264
- MD5 770057e7e4e9c87009731ff34e7efbdf
- SHA1 4f2ffae43172a6e670d982d644a9960240e995b1
- SHA512 6e2a2c4890bd912873c227f272e9a808f46a5e3a9387ca2a758d408c4f9301746e8f20e5fcde7d1b006debb2dbaf174c60c2d06470f311c07e0f9ca0e4285a5d
- SSDEEP 6144:XXaMySvL0DLf+FsJrc/7Ntj/J4xW1V8hqqQctkkJtjBxw+RZ840XmzSWOpsk15m:XqMFjywNV/J4jlLdxw+38hIS225m
- TLSH
  T1ABA46DA2F5A5105DD9BACD38835BA131FA307895835552DB2390F6302E2AAF19F3DFD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  post-fs-data.sh
- Size 1KB
- SHA256 c8e4e63d689098d7eb9440ffb75c0718d192311c6cf003c96fb51f47fbff4bc5
- MD5 edd3ea0b9f5c7aa82220bb852dc2839d
- SHA1 46783b676eafb713bdf772060dec5ce9e8d55e2f
- SHA512 da321e89e8984912c37086c5538cf841c700672b85b01c7200ee386b4cdf740ef4edaac6ae3ecc0a362f8dde678cbeca3fbd0fd2ee3f6d87ebc952475db171fd
- TLSH
  T13D2188561A65617FB8A0248A53B2E831A5E690C50494313F7E9FF09CA738E62B47B031
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  service.sh
- Size 458B
- SHA256 1e5156ee6c5347f7115de51c51b653f8fd1b19cde7e05e703c1b53c16c556792
- MD5 1ceeb2b0827611b5d2d4b0d55d906693
- SHA1 d825190e963d24967fa96502db3ad4070da739b1
- SHA512 f01efd8ed8cef5e8f20422010128a1fb5006b63d5445253c101f8b4e2490d039cce3b4b76b935f2b071e0d13955d3056e1eb773dfaf8aefca89f3f9258c33ae7
- TLSH
  T1DDF05513179412FE281002866EC3DC08622D508BCAA038A0B29CF48CBF7062EBCFF364
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  action.sh
- Size 192B
- SHA256 735832b17b3f2f9dd215a6f1d90a58b75e3a1d6d3ca8ffbbb5ab287f2b2a428c
- MD5 fd2dc6f368cce9b4f5c4d73dac4a0915
- SHA1 bfc6bbf810d750554558055338f67e819d4dd9bf
- SHA512 a2722edee69a502b23e738625e1c8e498cf7cdf9b31f16cc2e5a1ad088f93f1142a648d4247a3fc71e9677c08d6db2a4af78922a3a15ff04cb8e4fab79ac14b0
- TLSH
  T146C0802E1395043D436FF8C1F1D0547F281E19F8E1A392611F14553D37E7961E0C8847
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  bin/arm64-v8a/dex2oat
- Size 218KB
- SHA256 b889aa6507460d59f0e09d02f1d235dc1bb1e99e2ab5a75a60890e60475de61e
- MD5 7586fda3825e1d62a08a65cd7e07d04f
- SHA1 fff5cac8f618e8edc78879d8b64c4fff0922950e
- SHA512 a4cb8f48afeb847d1caf2a2c2d263405b8fddf01cddab4019bf275f9f624859a7b9f9ff0711b780255de139ee6324e82b7e89a31cd2a248c30a9eb034c524ba4
- SSDEEP 3072:TmrGN+DFswveA5HptQDo9CiqEP21VYXET6PojrSY/iKyYYQgCOEw:aTFswveA5HhXXKr36E
- TLSH
  T15824291CED4DDC79EFC8B03C97091297372E34644154D35F0A61422EF9CB6EE6A3AA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  bin/arm64-v8a/liboat_hook.so
- Size 3.4MB
- SHA256 5598656d27ae94e3ce30227bd0ac528936bb61d65df4487ff26e0731bec9815a
- MD5 ce99b65d8cd0b5883823f90362745aa7
- SHA1 d08afd2f8b44247b0c679190bef1323fa2718714
- SHA512 07ef4219eb3fe700ad2b79101ff53c0f045f52051fbdba4ae4e01fbff500c35a4d1b4e4a1dcf4c3518bb3b7ea182b51d7ca28df6b9a7e853075d433ac38e35cd
- SSDEEP 49152:WWxaNShS/fR9F1PPDUUSk4HggfwD4evE2wzNgGBhk7aCODhb:WW9e8Pas
- TLSH
  T1DEF50821FB5ADE5ACC827A30586F27546730EC596F95839BC21AB03C7CB37AD8D0A741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32