Analysis Overview
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
Threat Level: Shows suspicious behavior
The file e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Checks CPU information
Checks memory information
Queries the mobile country code (MCC)
Registers a broadcast receiver at runtime (usually for listening for system events)
Obtains sensitive information copied to the device clipboard
Requests dangerous framework permissions
MITRE ATT&CK
Mobile Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-22 02:17
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-22 02:17
Reported
2024-05-22 02:20
Platform
android-x86-arm-20240514-en
Max time kernel
19s
Max time network
155s
Command Line
Signatures
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.212.227:443 | tcp | |
| GB | 142.250.180.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.178.14:443 | android.apis.google.com | tcp |
| GB | 142.250.200.46:443 | tcp | |
| GB | 142.250.180.2:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | f8213c8c960e8ffbd1e707bedf4b40c6 |
| SHA1 | 116ee475306f73fa11d77e2981a669377e2fa61f |
| SHA256 | 0a28acfbf04751c055b27915be62e0f252b2958c63ca541e32536a883eb165bd |
| SHA512 | 9ecb691c8480b68a515bb4404beccd988b07f58935b493689a675d45599d9724ed113b26a4ce25d2850a0b7715ce07fe690a57ce2f4422f7260952fcc1eac0c1 |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/pl.spyone.agent2/databases/database.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/pl.spyone.agent2/databases/database.db-wal
| MD5 | 52f6a6daf8114ffb7bbfd90e28528f47 |
| SHA1 | cdd4a5b21037a77d0200cfa4772b76ae807f66b1 |
| SHA256 | ecbb21d576a35cd8c0e1998bafca3d62632272014ea863869f3828b763cc9298 |
| SHA512 | 1594ce50438359a871db7ad1490a59c47804a3bb53bebb6e5805a9af4b8d18b805e99a4b32856587bb3fd98ce762898af4404fc6d46eae588bc601598a5fe2d0 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-22 02:17
Reported
2024-05-22 02:20
Platform
android-x64-20240514-en
Max time kernel
49s
Max time network
187s
Command Line
Signatures
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.204.74:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 172.217.16.238:443 | android.apis.google.com | tcp |
| GB | 172.217.169.14:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.200:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.187.238:443 | tcp | |
| GB | 142.250.200.2:443 | tcp | |
| GB | 172.217.16.228:443 | tcp | |
| GB | 172.217.16.228:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | a9b565442b9d36a1a1b8e1cc4e02f53e |
| SHA1 | 13d82e3a59a2ecea1af9a7c3be6327160de2f0a3 |
| SHA256 | 95069040a5481565780fdeed2ecaf7d2c614053af88077af40b24667a976ab51 |
| SHA512 | b85e369b82ca7bd162f657da0769fc0b98408ea93eb6d8f700480130d1904ac8b9089f872a0e8316ef4c6f98284310467061e62d075fbd69e308e234f1ddf880 |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | dd46d6cae176055d8617ceb3d40f1d96 |
| SHA1 | b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57 |
| SHA256 | c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96 |
| SHA512 | 54d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 30916f03800262265cf93c65f4fb9928 |
| SHA1 | f65de1d6116dbc460e1612b65b10dd7a33e5c8ef |
| SHA256 | 1a43083a2efe3294f3021572740f1b4ab4e3891dd326a371cae30d9cc809caf5 |
| SHA512 | dc2335ec59971e228c3e24c82189d29880498f28118f9bcb7017f79ccb339f6454d6a68f07209f62047530aca76f097108e4428b3f816c77700e3c35464dc223 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | dfb0b40b6d13add225994cf4a89231f6 |
| SHA1 | f8d814df8e06832c9f870c5c48d22468b2fb0cb2 |
| SHA256 | 309857a14b7bad8b5ace4a18264d583d5a67445eafa6c6c2944a69b27ee92e6f |
| SHA512 | ee1d8bf984ba6b1fb1cd73fdb5874f5fc9e11031b25ec5cf7075e6f0c9f225dc803b9847b3fb5c99a9ff517bb703613cf5439b6636a4b6e5046bc83aaba45433 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-05-22 02:17
Reported
2024-05-22 02:20
Platform
android-x64-arm64-20240514-en
Max time kernel
130s
Max time network
132s
Command Line
Signatures
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.169.14:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.178.14:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 216.58.204.72:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.200.36:443 | tcp | |
| GB | 142.250.200.36:443 | tcp | |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 142.250.178.4:443 | www.google.com | tcp |
Files
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 8d7c16f489ff5bdd765a42075dea16fc |
| SHA1 | b62ea715479868740e46bc05ef9a6eca7c8152d6 |
| SHA256 | 5656e0eeac3ca31d68dd1c90d220df1f6a02d9ac30bf5420b8fd6e17546371bd |
| SHA512 | b0f44aa9ea99091b4a583cca0b99ec16ab665cde7342464e93c76ba5a4e8199c5a7e753df7ec985f56c06c41af1b4cf2878e13938647362cdce8c41f416f1fa6 |
/data/user/0/pl.spyone.agent2/databases/database.db
| MD5 | 0379f2b646309bcd59a19760005dd257 |
| SHA1 | 9185b00c3401321841b1c7edd10624a13c2dd47f |
| SHA256 | 62c0d663334435c7b56f7ef5ee45ef1e1476f9ef39ea6667dd48962eadb0216f |
| SHA512 | 387a118af4cd9315a8e5323b7a2b78e5214b0556448cdf6a68335ecda5615dfd0c1ca0313d8b355e8489980635319d90f2b7b25889b1e556c11b7657bc184fe8 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 543c1be8d79ec5c940bf1af771d222b2 |
| SHA1 | a87d57edf60c023ba6d385e5a2d5b816b61a7ccd |
| SHA256 | db21988720da7f09dc152ec42ec4b8fa716c14e0eb075545f1a3fbee7afa25b7 |
| SHA512 | 71bf5964688f353b74abd93dbab5c296e3d5a5b610477200d6e40cb1e9cba45a980a88b4ea5e5c1fc2ee79492fa67ea6c747726bffd230d26827490fe07b3070 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | d0764bda8e373760301ca7d70d7e81f5 |
| SHA1 | 435b07be745210c2546bfe710ad748f1d546b562 |
| SHA256 | ff74153e04fcc067af66f7617a78f10c8c42f2e023abe3ce0dacc78129abfea6 |
| SHA512 | 5bc4a2bb800fecd159e124081eb7de104d9c16a135e9ea135829be1f488076f4ac20150d0d51aae8df1e0fd6d999d5ea4e02136729009b0c09a27a37fbf60326 |