Malware Analysis Report

2024-07-28 14:32

Sample ID 240613-rzbm3sshng
Target http://intljs.rmtag.com
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

Threat Level: No (potentially) malicious behavior was detected

The file http://intljs.rmtag.com was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:37

Reported

2024-06-13 14:40

Platform

android-x64-arm64-20240611.1-en

Max time kernel

124s

Max time network

132s

Command Line

com.android.chrome

Signatures

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.238:443 android.apis.google.com tcp
US 1.1.1.1:53 intljs.rmtag.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 64.233.166.84:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 intljs.rmtag.com udp
BE 142.250.110.84:443 accounts.google.com tcp
US 34.102.147.248:80 intljs.rmtag.com tcp
US 34.102.147.248:443 intljs.rmtag.com tcp
US 34.102.147.248:80 intljs.rmtag.com tcp
US 34.102.147.248:443 intljs.rmtag.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.178.3:443 update.googleapis.com tcp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 update.googleapis.com udp
GB 172.217.16.227:443 update.googleapis.com tcp

Files

files/dom-0.html

MD5 cecb649cb1fb79c3736936fcbef3bbf2
SHA1 2c95183d7d2b0cd68d15b3c4115189351fc08720
SHA256 09bda72e7c32a69e3268e0ebd8caa33684cbc954dd00c7d93a38830e348ef324
SHA512 b8aca3cf0ea838093bd29b70ead608597260b0e35886d491d17c304878f99510fd885d96a191080acb5b706a642253bd9cbe5065ff234472b048fcce282061de