Malware Analysis Report

2024-11-16 10:45

Sample ID 240603-kmbc8ahd2z
Target https://www.youtube.com/watch?v=zutsGuUBFpo
Tags
discovery evasion
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

Threat Level: Shows suspicious behavior

The file https://www.youtube.com/watch?v=zutsGuUBFpo was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 08:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 08:42

Reported

2024-06-03 09:32

Platform

android-33-x64-arm64-20240514-en

Max time kernel

1815s

Max time network

1818s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
GB 216.58.204.68:443 udp
GB 216.58.204.68:443 udp
N/A 224.0.0.251:5353 udp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.178.14:443 udp
GB 142.250.178.14:443 tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 www.youtube.com udp
GB 142.250.178.14:443 www.youtube.com tcp
GB 142.250.178.14:443 www.youtube.com tcp
US 1.1.1.1:53 m.youtube.com udp
GB 142.250.180.14:443 m.youtube.com tcp
GB 142.250.178.14:443 www.youtube.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 74.125.71.84:443 accounts.google.com tcp
US 1.1.1.1:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 172.64.41.3:443 chrome.cloudflare-dns.com tcp
US 172.64.41.3:443 chrome.cloudflare-dns.com tcp
US 162.159.61.3:443 chrome.cloudflare-dns.com tcp
US 162.159.61.3:443 chrome.cloudflare-dns.com tcp
US 172.64.41.3:443 chrome.cloudflare-dns.com tcp
US 172.64.41.3:443 chrome.cloudflare-dns.com tcp
US 1.1.1.1:53 safebrowsing.googleapis.com udp
GB 216.58.204.74:443 safebrowsing.googleapis.com tcp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.179.238:443 www.youtube.com udp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
BE 142.251.168.84:443 udp
US 1.1.1.1:53 gmscompliance-pa.googleapis.com udp
GB 216.58.201.106:443 gmscompliance-pa.googleapis.com tcp
US 1.1.1.1:53 update.googleapis.com udp
NL 172.217.132.231:443 rr2---sn-5hne6n6e.googlevideo.com tcp
NL 172.217.132.231:443 rr2---sn-5hne6n6e.googlevideo.com tcp
GB 142.250.178.3:443 update.googleapis.com tcp
NL 209.85.226.9:443 udp
NL 209.85.226.9:443 tcp
GB 142.250.187.234:443 gmscompliance-pa.googleapis.com tcp
GB 216.58.201.106:443 gmscompliance-pa.googleapis.com udp
GB 172.217.169.65:443 yt3.ggpht.com tcp
GB 216.58.201.106:443 gmscompliance-pa.googleapis.com tcp
GB 216.58.201.106:443 gmscompliance-pa.googleapis.com tcp
NL 172.217.132.231:443 udp
GB 172.217.169.10:443 remoteprovisioning.googleapis.com udp
GB 172.217.16.226:443 tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net tcp
GB 172.217.16.226:443 udp
GB 216.58.212.202:443 gmscompliance-pa.googleapis.com udp
GB 216.58.213.6:443 static.doubleclick.net tcp
GB 142.250.179.228:443 udp
GB 216.58.204.68:443 udp
GB 216.58.204.68:443 tcp
GB 216.58.204.68:443 tcp
GB 216.58.204.68:443 tcp
GB 216.58.201.100:443 udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.110:443 www.youtube.com tcp
GB 216.58.201.110:443 www.youtube.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.179.228:443 udp
GB 142.250.179.228:443 udp
GB 172.217.16.226:443 udp
NL 172.217.132.231:443 udp
NL 172.217.132.231:443 udp
GB 142.250.179.228:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.180.14:443 m.youtube.com udp
GB 142.250.179.228:443 udp
US 1.1.1.1:53 gmscompliance-pa.googleapis.com udp
GB 142.250.200.34:443 tcp
GB 142.250.187.200:443 tcp
GB 142.250.200.34:443 tcp
GB 142.250.200.38:80 tcp
GB 142.250.200.38:443 tcp
GB 216.58.212.194:443 tcp
GB 142.250.187.206:443 www.youtube.com tcp
US 216.239.32.36:443 tcp
GB 142.250.179.234:443 gmscompliance-pa.googleapis.com tcp
NL 172.217.132.231:443 udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.179.228:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 216.58.204.78:443 www.youtube.com udp
GB 142.250.179.228:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.187.228:443 udp
NL 172.217.132.231:443 udp
NL 172.217.132.231:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.179.238:443 www.youtube.com udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.187.228:443 udp
NL 172.217.132.231:443 udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 udp
NL 172.217.132.231:443 udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 172.217.169.68:443 udp
GB 142.250.179.238:443 www.youtube.com udp
GB 172.217.169.68:443 udp
NL 172.217.132.231:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.180.4:443 udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 216.58.204.78:443 www.youtube.com udp
GB 142.250.180.4:443 udp
GB 216.58.204.78:443 www.youtube.com udp
GB 142.250.180.4:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.178.14:443 www.youtube.com udp
GB 142.250.179.246:443 i.ytimg.com tcp
GB 142.250.200.35:443 udp
GB 142.250.178.3:443 update.googleapis.com udp
GB 142.250.180.4:443 udp
US 172.64.41.3:443 chrome.cloudflare-dns.com udp
GB 142.250.200.46:443 www.youtube.com udp
GB 142.250.180.4:443 udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.36:443 www.google.com udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 162.159.61.3:443 chrome.cloudflare-dns.com udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 udp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 162.159.61.3:443 chrome.cloudflare-dns.com udp
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 udp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
US 1.1.1.1:53 chrome.cloudflare-dns.com udp
US 162.159.61.3:443 chrome.cloudflare-dns.com udp
GB 142.250.180.4:443 udp
GB 142.250.180.4:443 udp
US 162.159.61.3:443 chrome.cloudflare-dns.com udp
GB 142.250.180.4:443 udp

Files

files/dom-0.html

MD5 25e021b7301aa5028e68bc3a79b30d6a
SHA1 1fa9e637567804c7fe731497842ecacbd9bf2649
SHA256 4083596615cc67538752eb5d5f1951c2384e39985a3b757e9ff4d4da2619f1f3
SHA512 4a292839fac683456d77ac071b8e5f87b1daf926ba72d90357c7b38da9b19ddabddf60e9b340378bf099a985e8abdc843d70ce92738887e1d1f488b9d57de602