Analysis
-
max time kernel
49s -
max time network
187s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
22-05-2024 02:17
General
-
Target
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
-
Size
2.0MB
-
MD5
71f6cdb3d8eebe1c8e7e26896238e571
-
SHA1
019134386a6d900d61285e5e986249928a9504b6
-
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
-
SHA512
740e8bcde7462b99972ea472ee0cae53f4f61fcdc6d9ca1c8c44d0661323178c891f7fe82052cd7bae7239d7a953a6dcdb5e6fc42b28cd4acc9e1634e284228b
-
SSDEEP
49152:I8FjWz5Kzip37zl3fg1S1RvyzHth1mFI1/3Go1eiUMG1VummJwga8TGi3U/kX1l5:IIhup37zlviS1GHoFW3aiUM6ummJwgaE
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
pl.spyone.agent21⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/pl.spyone.agent2/databases/database.dbFilesize
76KB
MD5dd46d6cae176055d8617ceb3d40f1d96
SHA1b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57
SHA256c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96
SHA51254d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
512B
MD5a9b565442b9d36a1a1b8e1cc4e02f53e
SHA113d82e3a59a2ecea1af9a7c3be6327160de2f0a3
SHA25695069040a5481565780fdeed2ecaf7d2c614053af88077af40b24667a976ab51
SHA512b85e369b82ca7bd162f657da0769fc0b98408ea93eb6d8f700480130d1904ac8b9089f872a0e8316ef4c6f98284310467061e62d075fbd69e308e234f1ddf880
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD530916f03800262265cf93c65f4fb9928
SHA1f65de1d6116dbc460e1612b65b10dd7a33e5c8ef
SHA2561a43083a2efe3294f3021572740f1b4ab4e3891dd326a371cae30d9cc809caf5
SHA512dc2335ec59971e228c3e24c82189d29880498f28118f9bcb7017f79ccb339f6454d6a68f07209f62047530aca76f097108e4428b3f816c77700e3c35464dc223
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD5dfb0b40b6d13add225994cf4a89231f6
SHA1f8d814df8e06832c9f870c5c48d22468b2fb0cb2
SHA256309857a14b7bad8b5ace4a18264d583d5a67445eafa6c6c2944a69b27ee92e6f
SHA512ee1d8bf984ba6b1fb1cd73fdb5874f5fc9e11031b25ec5cf7075e6f0c9f225dc803b9847b3fb5c99a9ff517bb703613cf5439b6636a4b6e5046bc83aaba45433