Analysis Overview
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
Threat Level: Shows suspicious behavior
The file e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obtains sensitive information copied to the device clipboard
Requests dangerous framework permissions
Queries the mobile country code (MCC)
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks CPU information
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-08 02:02
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-08 02:02
Reported
2024-06-08 02:06
Platform
android-x86-arm-20240603-en
Max time kernel
19s
Max time network
131s
Command Line
Signatures
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.16.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 88c76cee5746db8f095de2a638695dd0 |
| SHA1 | bb1f3ab138b2a5de9dd16e132abf95172da9f5b8 |
| SHA256 | 31ed6d03e6a6e42f1db5bd6578f5a8a4838c58f0ca0f0573f964f7485ed5f982 |
| SHA512 | 0b7853149270b271ac316d4bab18bead7fd6ef49666bd9570e6d4e31ad17293c9a9b5ee376738fcfea4a58b0b9eef22055b30f09594c81057c3b7c7a472253b8 |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/pl.spyone.agent2/databases/database.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/pl.spyone.agent2/databases/database.db-wal
| MD5 | 0f92e20c91c4dec17db1e3b3f059336d |
| SHA1 | 275c29b72f4c344f95d98dcb64b389620a6c3ac3 |
| SHA256 | d49a8e21737766090cbf922445973550364dba7802c04d66bdc20940e9fe7c8d |
| SHA512 | b60bee71956b5e8afbc4e3a5d31f8116d2cbf3ad3bb7e3fbaf4d1ca7e97a85672c55b27b6ffcde18f21f87cd38048c63fa18ede0db6943b037cd0408544b18a7 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-08 02:02
Reported
2024-06-08 02:06
Platform
android-x64-20240603-en
Max time kernel
20s
Max time network
131s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.201.106:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.178.14:443 | android.apis.google.com | tcp |
| GB | 216.58.213.14:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.178.8:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.187.194:443 | tcp | |
| GB | 142.250.178.14:443 | android.apis.google.com | tcp |
| GB | 142.250.187.228:443 | tcp | |
| GB | 142.250.187.228:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | ef66633d9022ca940d0424098c176041 |
| SHA1 | 34e124ed33670c44dd0fe34c1819c374e7895ead |
| SHA256 | 774bdf37211824683bd85e1fd30256a362682ee7a6d68637e9df0545b02d6730 |
| SHA512 | f803bd1fa12b622609a3033d53689913369f72c5b4bb4f1d91a9d8b3148a6e8b3b876ff6cd9fc3e4896bf67443e439bc7e0be6bcc746a4bb3d8f949ba04dd738 |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | dd46d6cae176055d8617ceb3d40f1d96 |
| SHA1 | b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57 |
| SHA256 | c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96 |
| SHA512 | 54d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 536a3be5f2f5b22b3528e710209e0f97 |
| SHA1 | 011f1bf3d7416bd6c07f76f481424eb24b2dab44 |
| SHA256 | b5f965b689c3963ba0f6b38cdca174a87e3c0c3f8dfbc7f878aa6b97b8256cb3 |
| SHA512 | 03e52d3932af7c4d16b56221e2e94d2b184a97e28260753b295298889808554ffa53c0e5d2fc2c682c8f88828313a9a0072396975ebf7bcc2823faaa014d7926 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 78de04cd62de4e4b8e8c27ac23372227 |
| SHA1 | 81497ee2593d2edd9e378f127ae7c1642630f3f1 |
| SHA256 | 07d2b906c7e731732ad94104bacf4777b4c681654608d4976e9efcf34b51f79d |
| SHA512 | a8b4a596fedbe20437d864cd4fefc5c4fb67ad9835e05442dbc2c9eedef82d72ecaf1f24e3b800069fb2d7316dad1499ed829381f413ba6bf2c75a0268c885d0 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-08 02:02
Reported
2024-06-08 02:06
Platform
android-x64-arm64-20240603-en
Max time kernel
20s
Max time network
132s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.234:443 | tcp | |
| GB | 142.250.187.234:443 | tcp | |
| GB | 142.250.179.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.180.8:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.180.4:443 | tcp | |
| GB | 142.250.180.4:443 | tcp |
Files
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 8af2f1bbe1f6db4144a85c30c2895d8c |
| SHA1 | 7217c1705f2753f851274c257b9c434b9bc43dbb |
| SHA256 | a6058b39aaaa8b6d416bfcc9956ede68ac8b83e3af1e9a0545a4fa063f39f3fc |
| SHA512 | 2e785853fb1b3883e0130596a061d18c3f002157106bdefe085f417a4fbc8209854769480909b35abcee9b27f456a7c2836bacd2385d1960df4e3ee6b9525a66 |
/data/user/0/pl.spyone.agent2/databases/database.db
| MD5 | 0379f2b646309bcd59a19760005dd257 |
| SHA1 | 9185b00c3401321841b1c7edd10624a13c2dd47f |
| SHA256 | 62c0d663334435c7b56f7ef5ee45ef1e1476f9ef39ea6667dd48962eadb0216f |
| SHA512 | 387a118af4cd9315a8e5323b7a2b78e5214b0556448cdf6a68335ecda5615dfd0c1ca0313d8b355e8489980635319d90f2b7b25889b1e556c11b7657bc184fe8 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 4942964890260187945958f6174c595a |
| SHA1 | 84f38477180f3e82290c17a893b425dc62ed7fa7 |
| SHA256 | 7f0ea6e23f9c96cfeb5a8dd4f8104d4c626f050f0bbb6fbae7803410e35c7000 |
| SHA512 | 6c93b5e5a453340289cabac4366aa1b8cec68306ab505efc1852ad1d889e46f2924c00fddc9bc88434ffedf6cd183c2d70f3512c80a10213c4f2606bad3fbaad |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 770a4e0b2ca48d5fd3e594b6ff2f1892 |
| SHA1 | 43e1270227f02df82d06ba071275eef91a715dbd |
| SHA256 | cea2734c785c27c915550a8472a310b951057623f47acc412d96207668547c0f |
| SHA512 | 317d46c86c06f06a1204e1b7b6c7641d09ed277040ff342cc8da66cc985bbd1a3f9f0f2723d56bb8200bd308eecd4a75e28dce7ee8c5fd708a4b2a3a6f7fc5ed |