Analysis
-
max time kernel
49s -
max time network
153s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
-
submitted
14-06-2024 02:08
General
-
Target
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
-
Size
2.0MB
-
MD5
71f6cdb3d8eebe1c8e7e26896238e571
-
SHA1
019134386a6d900d61285e5e986249928a9504b6
-
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
-
SHA512
740e8bcde7462b99972ea472ee0cae53f4f61fcdc6d9ca1c8c44d0661323178c891f7fe82052cd7bae7239d7a953a6dcdb5e6fc42b28cd4acc9e1634e284228b
-
SSDEEP
49152:I8FjWz5Kzip37zl3fg1S1RvyzHth1mFI1/3Go1eiUMG1VummJwga8TGi3U/kX1l5:IIhup37zlviS1GHoFW3aiUM6ummJwgaE
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
pl.spyone.agent21⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/pl.spyone.agent2/databases/database.dbFilesize
76KB
MD5dd46d6cae176055d8617ceb3d40f1d96
SHA1b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57
SHA256c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96
SHA51254d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
512B
MD545b37a56dd857d9ee0d3f4354bb73e62
SHA14a1ea77c9ce8992bd034167adc1470fac0ee0a42
SHA2560e7d8ca3184b4b22848a4281c11c1807555e3e71a375b7aeba518b7e0c2f3125
SHA512b8257ba09655602fb433190c2e79cb1951dc76fa6ad0467de341ae078075b319d88e5b22413ac423c85f6f4f789ab204e667555562904a612f240d39875b79dc
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD56de6a94ed31377226a2fc94f5f6a3fa0
SHA1e16a8b11295e717309e619c6cfe111bac3c5e9ff
SHA25602d1e807d57e43a643929a307594d2760396f12f11e026793e22f5c8b7b9cc5e
SHA51283c295d5ef8659febdb04a1818a32094e8506169a70e76bc50832cc0a5b56530c65959081754e5fe190308deac43dbccb09ff2cb8946fbf1289abbd758384e96
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD550ec08521ebc7ec77bdd509a132a8229
SHA171a5f24f5d3e03751bf1aba3e44c8737dd843460
SHA256abf2fcb495c74821113c69219c4a7ed7be6f33629f812e42955c19aab0eeb543
SHA512e4b6202efcd2877350b79cd7c721647e4c3aff22ba627181e69eba699022d2c5305a02dbfced8b33e7e3ca9b92493bda3e1f5f7bfa5c82c0943e766f5c4293b3