Analysis Overview
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
Threat Level: Shows suspicious behavior
The file e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obtains sensitive information copied to the device clipboard
Requests dangerous framework permissions
Queries the mobile country code (MCC)
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks CPU information
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-11 02:07
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-11 02:06
Reported
2024-06-11 02:10
Platform
android-x86-arm-20240603-en
Max time kernel
18s
Max time network
160s
Command Line
Signatures
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 19cba9685529e79cf1696a9275dd4c33 |
| SHA1 | 4b11168da2eb18105fab6f420b8d614c877a06e2 |
| SHA256 | 642605b7eec0192cb6bec0211419d905e199fb609878c5c938b5f783f0d5051c |
| SHA512 | fbf1795f3aa2598e79ded5e7610dcaceb32919e05f2ba16c893d3f45108dde8b875f748614634213910c7c4d5b614c975a836d47fad209df8419aa147b5f3953 |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/pl.spyone.agent2/databases/database.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/pl.spyone.agent2/databases/database.db-wal
| MD5 | b8da36453e64a77d0a0be86eb2dbef63 |
| SHA1 | f8c72e5a7e532be6c9ec63addcff9c84259e5cf4 |
| SHA256 | b14ef6ecf35efedbd102e69cdb6a0b87e7cc6c2339ceac6d65d18922078b3744 |
| SHA512 | a9b44d08a94a1c087ffcef5de89dda03617189b0d93eb7a5658bdaae8de6dff216e9f43aeb7807da7a8711e7eb9ae5096c0833486f764a58cfe61e7c2a1ff5a5 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-11 02:06
Reported
2024-06-11 02:10
Platform
android-x64-20240603-en
Max time kernel
19s
Max time network
137s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 172.217.16.232:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.187.234:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| GB | 172.217.169.14:443 | tcp | |
| GB | 142.250.187.226:443 | tcp | |
| GB | 142.250.187.228:443 | tcp | |
| US | 1.1.1.1:53 | www.google.com | udp |
| US | 1.1.1.1:53 | www.google.com | udp |
| GB | 216.58.204.68:443 | www.google.com | tcp |
| GB | 142.250.200.14:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | e3797d04fb5eec7ccc3ad0f9a0ce96cf |
| SHA1 | ff187b2601df859de30622730477fe262d77c9ee |
| SHA256 | 0b1216a5ccf2a0d7d67be650cb59397f8901f527eb6b4c439da3ea0ad576c050 |
| SHA512 | 0cdaca097df46b9a5b7c9a8ddb0b64bd250f5389d3fae8f3d4965b6ca38197a9ce3f9b7c663d5885b7c257715f57a05e74e1934d958560877ceb3d48a5b0862f |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | dd46d6cae176055d8617ceb3d40f1d96 |
| SHA1 | b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57 |
| SHA256 | c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96 |
| SHA512 | 54d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 150a75e709f35920938ac5e669e58deb |
| SHA1 | 48fa9cc8310ca2417e438e3ec825cd4d7fd2f09e |
| SHA256 | fe89f030195471f505d1d0fc7ed8c24c4235f9ae641df28fc1e57a3fe28b6fd5 |
| SHA512 | d4c9ea9b8636360c8a3e07fadbca01debd920bd211a8d2623bf1c259596f09f975167820470c9f2017f510fb1c1c45b4c224b3246189b6fc6f595c9f6a7716cc |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 67df33ee3c5df5228b2493740963b6f4 |
| SHA1 | e7a83e766f870c09cfd809ec53d3a91fc84367f7 |
| SHA256 | a19808437d209e60d08d22df93e36e321f7aa5f796140d03dcabde337e00e3b5 |
| SHA512 | b7dc73a17bb4593f59fbcc4453b093ded7c18fca03118953707ff940b17a220bd8ed210d0e04f1f911732cb13a4d0ae3fba9e0612c2dac6cfff9e0f071891345 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-11 02:06
Reported
2024-06-11 02:10
Platform
android-x64-arm64-20240603-en
Max time kernel
19s
Max time network
132s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.238:443 | tcp | |
| GB | 142.250.187.238:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.187.232:443 | ssl.google-analytics.com | tcp |
| GB | 142.250.180.4:443 | tcp | |
| GB | 142.250.180.4:443 | tcp | |
| GB | 142.250.180.4:443 | tcp | |
| GB | 142.250.180.4:443 | tcp |
Files
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 37d1550de72e266e90f75c88b100b4a7 |
| SHA1 | 347102c649a965c876836924bd73cb43bc13fb1b |
| SHA256 | b8734f129c6b9ee414df93a7b2f212701e081778f0a1ed1ec3638b1a497a7c97 |
| SHA512 | 6027cfbfd0ab4dd630b461cea91e5b3655f9773a73f4d0a049cc6541b3b9ef012192c7d77dd9b2e0bc69a338a47db83b803dd5fce10ac2b9c674beb0a12f1084 |
/data/user/0/pl.spyone.agent2/databases/database.db
| MD5 | 0379f2b646309bcd59a19760005dd257 |
| SHA1 | 9185b00c3401321841b1c7edd10624a13c2dd47f |
| SHA256 | 62c0d663334435c7b56f7ef5ee45ef1e1476f9ef39ea6667dd48962eadb0216f |
| SHA512 | 387a118af4cd9315a8e5323b7a2b78e5214b0556448cdf6a68335ecda5615dfd0c1ca0313d8b355e8489980635319d90f2b7b25889b1e556c11b7657bc184fe8 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 7fe89f680af6eeab8a68bf95afd68774 |
| SHA1 | b0a538e386e3306ad5b768c7295c72bd9803a390 |
| SHA256 | 36b71e732249f8610dca1ce09d5b25c7d23f87f775223c3fc31bd34c58e16f00 |
| SHA512 | 09c11c8a669bc0b2296eb46b797c6c7e1e6d1a106534caabddd692e9606ed85895b3f2ebe2620463b2cb0f5d4f68caef728679fb230c2373e198a9d3567d70dc |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | facf43abcd1390717807d095b8085681 |
| SHA1 | 94feee3ff60f6a50cf3cdaa4e0cf4ea6725c6fcb |
| SHA256 | 06d4ada473cdef30357713e3cb53fb0b67049f00784e3aaca4246ddd9c5cf671 |
| SHA512 | 617a5b1987c91084dcea080bb99b8370a27fb9a61bc7592b91812753f08ca42968f57c539db597179062c7fd938274168ee9b6b28c2a7c2ca76f8e6f140e3558 |