Malware Analysis Report

2024-09-09 16:23

Sample ID 240611-cjyekszere
Target e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
SHA256 e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
Tags
discovery persistence collection credential_access impact
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8

Threat Level: Shows suspicious behavior

The file e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence collection credential_access impact

Obtains sensitive information copied to the device clipboard

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 02:07

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 02:06

Reported

2024-06-11 02:10

Platform

android-x86-arm-20240603-en

Max time kernel

18s

Max time network

160s

Command Line

pl.spyone.agent2

Signatures

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

pl.spyone.agent2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp

Files

/data/data/pl.spyone.agent2/databases/database.db-journal

MD5 19cba9685529e79cf1696a9275dd4c33
SHA1 4b11168da2eb18105fab6f420b8d614c877a06e2
SHA256 642605b7eec0192cb6bec0211419d905e199fb609878c5c938b5f783f0d5051c
SHA512 fbf1795f3aa2598e79ded5e7610dcaceb32919e05f2ba16c893d3f45108dde8b875f748614634213910c7c4d5b614c975a836d47fad209df8419aa147b5f3953

/data/data/pl.spyone.agent2/databases/database.db

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/pl.spyone.agent2/databases/database.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/pl.spyone.agent2/databases/database.db-wal

MD5 b8da36453e64a77d0a0be86eb2dbef63
SHA1 f8c72e5a7e532be6c9ec63addcff9c84259e5cf4
SHA256 b14ef6ecf35efedbd102e69cdb6a0b87e7cc6c2339ceac6d65d18922078b3744
SHA512 a9b44d08a94a1c087ffcef5de89dda03617189b0d93eb7a5658bdaae8de6dff216e9f43aeb7807da7a8711e7eb9ae5096c0833486f764a58cfe61e7c2a1ff5a5

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 02:06

Reported

2024-06-11 02:10

Platform

android-x64-20240603-en

Max time kernel

19s

Max time network

137s

Command Line

pl.spyone.agent2

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

pl.spyone.agent2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
GB 142.250.187.234:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
GB 172.217.169.14:443 tcp
GB 142.250.187.226:443 tcp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 www.google.com udp
US 1.1.1.1:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 142.250.200.14:443 tcp

Files

/data/data/pl.spyone.agent2/databases/database.db-journal

MD5 e3797d04fb5eec7ccc3ad0f9a0ce96cf
SHA1 ff187b2601df859de30622730477fe262d77c9ee
SHA256 0b1216a5ccf2a0d7d67be650cb59397f8901f527eb6b4c439da3ea0ad576c050
SHA512 0cdaca097df46b9a5b7c9a8ddb0b64bd250f5389d3fae8f3d4965b6ca38197a9ce3f9b7c663d5885b7c257715f57a05e74e1934d958560877ceb3d48a5b0862f

/data/data/pl.spyone.agent2/databases/database.db

MD5 dd46d6cae176055d8617ceb3d40f1d96
SHA1 b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57
SHA256 c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96
SHA512 54d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516

/data/data/pl.spyone.agent2/databases/database.db-journal

MD5 150a75e709f35920938ac5e669e58deb
SHA1 48fa9cc8310ca2417e438e3ec825cd4d7fd2f09e
SHA256 fe89f030195471f505d1d0fc7ed8c24c4235f9ae641df28fc1e57a3fe28b6fd5
SHA512 d4c9ea9b8636360c8a3e07fadbca01debd920bd211a8d2623bf1c259596f09f975167820470c9f2017f510fb1c1c45b4c224b3246189b6fc6f595c9f6a7716cc

/data/data/pl.spyone.agent2/databases/database.db-journal

MD5 67df33ee3c5df5228b2493740963b6f4
SHA1 e7a83e766f870c09cfd809ec53d3a91fc84367f7
SHA256 a19808437d209e60d08d22df93e36e321f7aa5f796140d03dcabde337e00e3b5
SHA512 b7dc73a17bb4593f59fbcc4453b093ded7c18fca03118953707ff940b17a220bd8ed210d0e04f1f911732cb13a4d0ae3fba9e0612c2dac6cfff9e0f071891345

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-11 02:06

Reported

2024-06-11 02:10

Platform

android-x64-arm64-20240603-en

Max time kernel

19s

Max time network

132s

Command Line

pl.spyone.agent2

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

pl.spyone.agent2

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.238:443 tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp

Files

/data/user/0/pl.spyone.agent2/databases/database.db-journal

MD5 37d1550de72e266e90f75c88b100b4a7
SHA1 347102c649a965c876836924bd73cb43bc13fb1b
SHA256 b8734f129c6b9ee414df93a7b2f212701e081778f0a1ed1ec3638b1a497a7c97
SHA512 6027cfbfd0ab4dd630b461cea91e5b3655f9773a73f4d0a049cc6541b3b9ef012192c7d77dd9b2e0bc69a338a47db83b803dd5fce10ac2b9c674beb0a12f1084

/data/user/0/pl.spyone.agent2/databases/database.db

MD5 0379f2b646309bcd59a19760005dd257
SHA1 9185b00c3401321841b1c7edd10624a13c2dd47f
SHA256 62c0d663334435c7b56f7ef5ee45ef1e1476f9ef39ea6667dd48962eadb0216f
SHA512 387a118af4cd9315a8e5323b7a2b78e5214b0556448cdf6a68335ecda5615dfd0c1ca0313d8b355e8489980635319d90f2b7b25889b1e556c11b7657bc184fe8

/data/user/0/pl.spyone.agent2/databases/database.db-journal

MD5 7fe89f680af6eeab8a68bf95afd68774
SHA1 b0a538e386e3306ad5b768c7295c72bd9803a390
SHA256 36b71e732249f8610dca1ce09d5b25c7d23f87f775223c3fc31bd34c58e16f00
SHA512 09c11c8a669bc0b2296eb46b797c6c7e1e6d1a106534caabddd692e9606ed85895b3f2ebe2620463b2cb0f5d4f68caef728679fb230c2373e198a9d3567d70dc

/data/user/0/pl.spyone.agent2/databases/database.db-journal

MD5 facf43abcd1390717807d095b8085681
SHA1 94feee3ff60f6a50cf3cdaa4e0cf4ea6725c6fcb
SHA256 06d4ada473cdef30357713e3cb53fb0b67049f00784e3aaca4246ddd9c5cf671
SHA512 617a5b1987c91084dcea080bb99b8370a27fb9a61bc7592b91812753f08ca42968f57c539db597179062c7fd938274168ee9b6b28c2a7c2ca76f8e6f140e3558