Malware analysis http://dgnv.ecsmpjihl.com/marketdatas/apk/mgsMob/5.13.8/mgsMob_5.13.8.apk Malicious activity

Add for printing

URL:	http://dgnv.ecsmpjihl.com/marketdatas/apk/mgsMob/5.13.8/mgsMob_5.13.8.apk
Full analysis:	https://app.any.run/tasks/123a4fa3-54e3-42b4-9b22-47e1a5b8e9fc
Verdict:	Malicious activity
Analysis date:	October 03, 2025, 16:34:04
OS:	Android 14
Tags:	websocket
Indicators:
MD5:	0AFDA6CE362CFA925C1BE383E345EF45
SHA1:	0A8019690ECB36ADA58A38BAFF7FB6542F0F861B
SHA256:	AB1D3CBC0AD65DFF2892B373C727839A6B35FD1C4AF3498C1D69D359D47BA1A9
SSDEEP:	3:N1KaCneFJLKTxsVC7QLUcK/WoKXpLfn:CauCLuxMELDWoGlfn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

android (14)
android.cuttlefish.overlay (14)
android.cuttlefish.phone.overlay (14)
android.ext.services (2019-09)
android.ext.shared (1)
com.android.adservices.api (14)
com.android.apps.tag (1.1)
com.android.backupconfirm (14)
com.android.bips (14)
com.android.bluetoothmidiservice (14)
com.android.bookmarkprovider (14)
com.android.calendar (14)
com.android.calllogbackup (14)
com.android.camera2 (2.0.002)
com.android.cameraextensions (14)
com.android.captiveportallogin (14)
com.android.carrierconfig (1.0.0)
com.android.carrierdefaultapp (14)
com.android.cellbroadcastreceiver (R-initial)
com.android.cellbroadcastreceiver.module (R-initial)
com.android.cellbroadcastservice (R-initial)
com.android.certinstaller (14)
com.android.companiondevicemanager (14)
com.android.compos.payload (14)
com.android.connectivity.resources (S-initial)
com.android.connectivity.resources.cuttlefish.overlay (14)
com.android.contacts (1.7.34)
com.android.credentialmanager (14)
com.android.cts.ctsshim (14-10093150)
com.android.cts.priv.ctsshim (14-10093150)
com.android.deskclock (14)
com.android.devicelockcontroller (14)
com.android.dialer (23.0)
com.android.documentsui (14)
com.android.dreams.basic (14)
com.android.dreams.phototable (14)
com.android.dynsystem (14)
com.android.egg (1.0)
com.android.emergency (14)
com.android.ext.adservices.api (14)
com.android.externalstorage (14)
com.android.federatedcompute.services (T-initial)
com.android.gallery3d (1.1.40030)
com.android.google.gce.gceservice (14)
com.android.health.connect.backuprestore (14)
com.android.healthconnect.controller (14)
com.android.hotspot2.osulogin (14)
com.android.htmlviewer (14)
com.android.imsserviceentitlement (14)
com.android.inputdevices (14)
com.android.inputmethod.latin (14)
com.android.intentresolver (2021-11)
com.android.internal.display.cutout.emulation.corner (1.0)
com.android.internal.display.cutout.emulation.double (1.0)
com.android.internal.display.cutout.emulation.hole (1.0)
com.android.internal.display.cutout.emulation.tall (1.0)
com.android.internal.display.cutout.emulation.waterfall (1.0)
com.android.internal.systemui.navbar.gestural (1.0)
com.android.internal.systemui.navbar.gestural_extra_wide_back (1.0)
com.android.internal.systemui.navbar.gestural_narrow_back (1.0)
com.android.internal.systemui.navbar.gestural_wide_back (1.0)
com.android.internal.systemui.navbar.threebutton (1.0)
com.android.internal.systemui.navbar.transparent (1.0)
com.android.keychain (14)
com.android.launcher3 (14)
com.android.localtransport (14)
com.android.location.fused (14)
com.android.managedprovisioning (14)
com.android.messaging (1.0.001)
com.android.microdroid.empty_payload (14)
com.android.mms.service (14)
com.android.modulemetadata (14)
com.android.mtp (14)
com.android.music (14)
com.android.musicfx (1.4)
com.android.nearby.halfsheet (14)
com.android.networkstack (T-next)
com.android.networkstack.tethering (14)
com.android.networkstack.tethering.cuttlefishoverlay (1.0)
com.android.nfc (14)
com.android.ondevicepersonalization.services (T-initial)
com.android.ons (14)
com.android.packageinstaller (14)
com.android.pacprocessor (14)
com.android.permissioncontroller (33 system image)
com.android.phone (14)
com.android.printservice.recommendation (1.3.0)
com.android.printspooler (14)
com.android.providers.blockednumber (14)
com.android.providers.calendar (14)
com.android.providers.contacts (14)
com.android.providers.downloads (14)
com.android.providers.downloads.ui (14)
com.android.providers.media (14)
com.android.providers.media.module (14)
com.android.providers.partnerbookmarks (14)
com.android.providers.settings (14)
com.android.providers.settings.cuttlefish.overlay (14)
com.android.providers.telephony (14)
com.android.providers.userdictionary (14)
com.android.provision (14)
com.android.proxyhandler (14)
com.android.quicksearchbox (14)
com.android.rkpdapp (14)
com.android.role.notes.enabled (1.0)
com.android.safetycenter.resources (33 system image)
com.android.sdksandbox (T-initial)
com.android.se (14)
com.android.server.telecom (14)
com.android.settings (14)
com.android.settings.intelligence (14)
com.android.sharedstoragebackup (14)
com.android.shell (14)
com.android.simappdialog (14)
com.android.soundpicker (14)
com.android.statementservice (1.0)
com.android.stk (14)
com.android.storagemanager (14)
com.android.systemui (14)
com.android.systemui.accessibility.accessibilitymenu (14)
com.android.telephony.qns (14)
com.android.theme.font.notoserifsource (1.0)
com.android.traceur (1.0)
com.android.uwb.resources (T-initial)
com.android.virtualmachine.res (14)
com.android.vpndialogs (14)
com.android.wallpaper.livepicker (14)
com.android.wallpaperbackup (14)
com.android.wallpapercropper (14)
com.android.wallpaperpicker (1.0)
com.android.webview (137.0.7122.0)
com.android.wifi.dialog (14)
com.android.wifi.resources (R-initial)
com.android.wifi.resources.cf (1.0)
com.google.android.telephony.satellite (14)
org.chromium.chrome (137.0.7122.0)

Add for printing

MALICIOUS
- Executes system commands or scripts
  - app_process64 (PID: 4303)
SUSPICIOUS
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 4303)
- Retrieves a list of running application processes
  - app_process64 (PID: 4303)
- Detects Xposed framework for modifications
  - app_process64 (PID: 4303)
- Updates data in the storage of application settings (SharedPreferences)
  - app_process64 (PID: 4303)
- Retrieves Android OS build information
  - app_process64 (PID: 4303)
- Accesses system-level resources
  - app_process64 (PID: 4303)
- Uses encryption API functions
  - app_process64 (PID: 4303)
- Accesses memory information
  - app_process64 (PID: 4303)
- Establishing a connection
  - app_process64 (PID: 4303)
- Detects when screen powers off
  - app_process64 (PID: 4303)
- Launches a new activity
  - app_process64 (PID: 4303)
- Returns the name of the current network operator
  - app_process64 (PID: 4303)
- Starts a service
  - app_process64 (PID: 4303)
- Accesses external device storage files
  - app_process64 (PID: 4303)
INFO
- Loads a native library into the application
  - app_process64 (PID: 4303)
- Dynamically inspects or modifies classes, methods, and fields at runtime
  - app_process64 (PID: 4303)
- Stores data using SQLite database
  - app_process64 (PID: 4303)
- Dynamically registers broadcast event listeners
  - app_process64 (PID: 4303)
- Verifies whether the device is connected to the internet
  - app_process64 (PID: 4303)
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 4303)
- Returns elapsed time since boot
  - app_process64 (PID: 4303)
- Dynamically loads a class in Java
  - app_process64 (PID: 4303)
- Gets file name without full path
  - app_process64 (PID: 4303)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 4303)
- Listens for connection changes
  - app_process64 (PID: 4303)
- Retrieves the value of a secure system setting
  - app_process64 (PID: 4303)
- Detects device power status
  - app_process64 (PID: 4303)
- Retrieves the value of a system setting
  - app_process64 (PID: 4303)
- Attempting to connect via WebSocket
  - app_process64 (PID: 4303)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

156

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3970	org.chromium.chrome	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4019	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4042	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
4064	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4082	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4134	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
4288	/apex/com.android.art/bin/artd	/apex/com.android.art/bin/artd	—	init
User: artd Integrity Level: UNKNOWN Exit code: 0
4291	/apex/com.android.art/bin/dex2oat32 --zip-fd=6 --zip-location=/data/app/~~IOlrRMQomAj9dU7QQ5NtdA==/com.msandroid.mobile-8pWrZVcMxYA9hm0_dzEvMg==/base.apk --oat-fd=7 --oat-location=/data/app/~~IOlrRMQomAj9dU7QQ5NtdA==/com.msandroid.mobile-8pWrZVcMxYA9hm0_dzEvMg==/oat/arm64/base.odex --output-vdex-fd=8 --swap-fd=9 --class-loader-context=PCL[] --classpath-dir=/data/app/~~IOlrRMQomAj9dU7QQ5NtdA==/com.msandroid.mobile-8pWrZVcMxYA9hm0_dzEvMg== --instruction-set=arm64 --instruction-set-features=default --instruction-set-variant=cortex-a53 --compiler-filter=verify --compilation-reason=install --compact-dex-level=none --max-image-block-size=524288 --resolve-startup-const-strings=true --generate-mini-debug-info --runtime-arg -Xtarget-sdk-version:33 --runtime-arg -Xhidden-api-policy:enabled --runtime-arg -Xms64m --runtime-arg -Xmx512m --comments=app-version-name:5.13.8,app-version-code:51308,art-version:340090000	/apex/com.android.art/bin/dex2oat32	—	artd
User: artd Integrity Level: UNKNOWN Exit code: 0
4303	com.msandroid.mobile	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
4388	getprop ro.build.version.emui	/system/bin/toolbox	—	app_process64
User: u0_a108 Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

Read events

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

166

Text files

151

Unknown types

Dropped files

PID	Process	Filename		Type
4303	app_process64	/data/data/com.msandroid.mobile/files/PersistedInstallation8420681893549592910tmp		binary
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/files/PersistedInstallation.W0RFRkFVTFRd+MToxODc2NzUyNDY3NTphbmRyb2lkOmM3NGYwM2Y4YTg2ODE1YzUzNWY1ZjY.json		binary
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/files/.com.google.firebase.crashlytics.files.v2:com.msandroid.mobile/open-sessions/68DFFB180105000110CF60951B79DA32/native/session.json		binary
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/shared_prefs/com.google.android.gms.measurement.prefs.xml		xml
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/shared_prefs/com.google.firebase.crashlytics.xml		xml
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/shared_prefs/com.google.firebase.inappmessaging.xml		xml
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/files/.com.google.firebase.crashlytics.files.v2:com.msandroid.mobile/open-sessions/68DFFB180105000110CF60951B79DA32/native/app.json		binary
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/files/.com.google.firebase.crashlytics.files.v2:com.msandroid.mobile/open-sessions/68DFFB180105000110CF60951B79DA32/native/os.json		binary
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/files/.com.google.firebase.crashlytics.files.v2:com.msandroid.mobile/open-sessions/68DFFB180105000110CF60951B79DA32/native/device.json		binary
		MD5:—	SHA256:—
4303	app_process64	/data/data/com.msandroid.mobile/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToxODc2NzUyNDY3NTphbmRyb2lkOmM3NGYwM2Y4YTg2ODE1YzUzNWY1ZjY.xml		xml
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	142.250.185.100:80	http://www.google.com/gen_204	US	—	—	whitelisted
1939	app_process64	GET	204	142.250.186.163:80	http://connectivitycheck.gstatic.com/generate_204	US	—	—	whitelisted
3970	app_process64	GET	200	142.250.185.142:80	http://clients2.google.com/time/1/current?cup2key=9:IaE34rplTB8NHb_MlSmpOeFyPT7NnuY5nfImL70AE7U&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	US	text	105 b	whitelisted
4303	app_process64	GET	200	188.114.97.3:80	http://jktgr.ludgwoxhe.com/MarketServer/update?action=checkUpdate&packagenamesAndVersioncodes=com.msandroid.mobile%2C51308&language=en&sn=vDedjnhT2IA%3D&userId=unknown	NL	xml	565 b	whitelisted
4303	app_process64	POST	200	104.21.12.105:80	http://skc2r.plracsimf.com/api/adserver/v2/get_content	unknown	binary	558 b	unknown
4303	app_process64	GET	200	188.114.96.3:80	http://miqe.sdxpkgyaq.com/media/adsys/504f35f9-acd1-4d06-9548-12cd6bfcb076.jpg	NL	image	872 Kb	whitelisted
4303	app_process64	GET	200	188.114.96.3:80	http://miqe.sdxpkgyaq.com/media/adsys/55fc3fe0-7633-4878-b798-03da14a06a44.png	NL	image	380 Kb	whitelisted
4303	app_process64	GET	200	188.114.96.3:80	http://miqe.sdxpkgyaq.com/media/adsys/89082139-f360-4031-92b1-55f678b8f3a9.jpg	NL	image	538 Kb	whitelisted
4303	app_process64	GET	101	104.18.53.63:80	http://bjac.mdj1kgdcv.com:80/v1/imagine	unknown	—	—	unknown
4303	app_process64	GET	200	188.114.97.3:80	http://g4tc2.irlapchbd.com/notice/api/get_notice?pkg=com.msandroid.mobile&v=51308&language=en&sn=809992392&userId=809992392	NL	binary	117 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
450	mdnsd	224.0.0.251:5353	—	—	—	whitelisted
—	—	142.250.185.100:80	www.google.com	GOOGLE	US	whitelisted
—	—	142.250.186.35:80	—	GOOGLE	US	whitelisted
—	—	142.250.185.100:443	www.google.com	GOOGLE	US	whitelisted
3970	app_process64	142.250.185.142:80	clients2.google.com	GOOGLE	US	whitelisted
3970	app_process64	64.233.167.84:443	accounts.google.com	GOOGLE	US	whitelisted
3970	app_process64	172.67.165.181:443	dgnv.ecsmpjihl.com	CLOUDFLARENET	US	unknown
3970	app_process64	142.250.185.100:443	www.google.com	GOOGLE	US	whitelisted
3970	app_process64	35.190.80.1:443	a.nel.cloudflare.com	GOOGLE	US	whitelisted
3970	app_process64	142.250.184.234:443	androidchromeprotect.pa.googleapis.com	GOOGLE	US	whitelisted

DNS requests

Domain	IP	Reputation
www.google.com	142.250.185.100	whitelisted
google.com	172.217.16.206	whitelisted
clients2.google.com	142.250.185.142	whitelisted
dgnv.ecsmpjihl.com	172.67.165.181 104.21.11.92	unknown
accounts.google.com	64.233.167.84	whitelisted
a.nel.cloudflare.com	35.190.80.1	whitelisted
androidchromeprotect.pa.googleapis.com	142.250.184.234	whitelisted
connectivitycheck.gstatic.com	142.250.186.163	whitelisted
time.android.com	216.239.35.8 216.239.35.4 216.239.35.12 216.239.35.0	unknown
staging-remoteprovisioning.sandbox.googleapis.com	74.125.71.81	whitelisted

Threats

PID	Process	Class	Message
3970	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3970	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
1939	app_process64	Misc activity	ET INFO Android Device Connectivity Check
4303	app_process64	Misc activity	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)
4303	app_process64	Misc activity	ET INFO Google DNS Over HTTPS Certificate Inbound
4303	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Websocket Upgrade Request
4303	app_process64	Generic Protocol Command Decode	SURICATA HTTP request field missing colon
4303	app_process64	Generic Protocol Command Decode	SURICATA HTTP request header invalid
4303	app_process64	Generic Protocol Command Decode	SURICATA HTTP METHOD terminated by non-compliant character

Add for printing

No debug info

General Info

http://dgnv.ecsmpjihl.com/marketdatas/apk/mgsMob/5.13.8/mgsMob_5.13.8.apk

0AFDA6CE362CFA925C1BE383E345EF45

0A8019690ECB36ADA58A38BAFF7FB6542F0F861B

AB1D3CBC0AD65DFF2892B373C727839A6B35FD1C4AF3498C1D69D359D47BA1A9

3:N1KaCneFJLKTxsVC7QLUcK/WoKXpLfn:CauCLuxMELDWoGlfn

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Executes system commands or scripts

SUSPICIOUS

Collects data about the device's environment (JVM version)

Retrieves a list of running application processes

Detects Xposed framework for modifications

Updates data in the storage of application settings (SharedPreferences)

Retrieves Android OS build information

Accesses system-level resources

Uses encryption API functions

Accesses memory information

Establishing a connection

Detects when screen powers off

Launches a new activity

Returns the name of the current network operator

Starts a service

Accesses external device storage files

INFO

Loads a native library into the application

Dynamically inspects or modifies classes, methods, and fields at runtime

Stores data using SQLite database

Dynamically registers broadcast event listeners

Verifies whether the device is connected to the internet

Retrieves data from storage of application settings (SharedPreferences)

Returns elapsed time since boot

Dynamically loads a class in Java

Gets file name without full path

Gets the display metrics associated with the device's screen

Listens for connection changes

Retrieves the value of a secure system setting

Detects device power status

Retrieves the value of a system setting

Attempting to connect via WebSocket

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings