Analysis Overview
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
Threat Level: Shows suspicious behavior
The file e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obtains sensitive information copied to the device clipboard
Requests dangerous framework permissions
Queries the mobile country code (MCC)
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks CPU information
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-14 02:08
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-14 02:08
Reported
2024-06-14 02:12
Platform
android-x86-arm-20240611.1-en
Max time kernel
18s
Max time network
131s
Command Line
Signatures
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.204.78:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | a8e78bce3c5a7f15cd0f0459ca6a7b57 |
| SHA1 | 2199f86d555f81efab7a3390ecfe0e7c2fbed689 |
| SHA256 | 88ad559a36373d3cd4119b28aa85177f7fcd7df0032831e9df9af0d16942f33e |
| SHA512 | 0a617d49dd03a54012c27679134907cecbf6dfeacde2aa8192cc38558a752c0acf6b1363d16355f31c7b29993eea68649cf90ba26d5b714b1eb1ad33a00ccd06 |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/pl.spyone.agent2/databases/database.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/pl.spyone.agent2/databases/database.db-wal
| MD5 | 5bcab16cd37dae5d56830b25a4339dad |
| SHA1 | 219edb3a0b407d18f0649557b5665372501820b4 |
| SHA256 | 336f4840579d79e4b12b949e8e5b403766ccf0334af39efccb02059eebcd8236 |
| SHA512 | 8d75638fb6363dadf5f63181ccc5c29cc3b38c7a161d22526bc75e55f960e51a19c2694324c0ff24054532fe89faaa6c45008968898700a0ee817bdf36334da8 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-14 02:08
Reported
2024-06-14 02:11
Platform
android-x64-20240611.1-en
Max time kernel
49s
Max time network
153s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.200.8:443 | ssl.google-analytics.com | tcp |
| GB | 172.217.16.234:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| GB | 172.217.169.46:443 | tcp | |
| GB | 142.250.178.4:443 | tcp | |
| GB | 142.250.178.4:443 | tcp | |
| GB | 172.217.16.226:443 | tcp | |
| GB | 142.250.178.14:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 45b37a56dd857d9ee0d3f4354bb73e62 |
| SHA1 | 4a1ea77c9ce8992bd034167adc1470fac0ee0a42 |
| SHA256 | 0e7d8ca3184b4b22848a4281c11c1807555e3e71a375b7aeba518b7e0c2f3125 |
| SHA512 | b8257ba09655602fb433190c2e79cb1951dc76fa6ad0467de341ae078075b319d88e5b22413ac423c85f6f4f789ab204e667555562904a612f240d39875b79dc |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | dd46d6cae176055d8617ceb3d40f1d96 |
| SHA1 | b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57 |
| SHA256 | c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96 |
| SHA512 | 54d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 6de6a94ed31377226a2fc94f5f6a3fa0 |
| SHA1 | e16a8b11295e717309e619c6cfe111bac3c5e9ff |
| SHA256 | 02d1e807d57e43a643929a307594d2760396f12f11e026793e22f5c8b7b9cc5e |
| SHA512 | 83c295d5ef8659febdb04a1818a32094e8506169a70e76bc50832cc0a5b56530c65959081754e5fe190308deac43dbccb09ff2cb8946fbf1289abbd758384e96 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 50ec08521ebc7ec77bdd509a132a8229 |
| SHA1 | 71a5f24f5d3e03751bf1aba3e44c8737dd843460 |
| SHA256 | abf2fcb495c74821113c69219c4a7ed7be6f33629f812e42955c19aab0eeb543 |
| SHA512 | e4b6202efcd2877350b79cd7c721647e4c3aff22ba627181e69eba699022d2c5305a02dbfced8b33e7e3ca9b92493bda3e1f5f7bfa5c82c0943e766f5c4293b3 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-14 02:08
Reported
2024-06-14 02:11
Platform
android-x64-arm64-20240611.1-en
Max time kernel
19s
Max time network
132s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.16.234:443 | tcp | |
| GB | 172.217.16.234:443 | tcp | |
| GB | 216.58.204.78:443 | tcp | |
| GB | 216.58.204.78:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.204.78:443 | android.apis.google.com | tcp |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.178.4:443 | tcp | |
| GB | 142.250.178.4:443 | tcp |
Files
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | e71471a276930bd34c3f4d8caa21757c |
| SHA1 | 7db784b0e3b6436d4dc7eba50e62b601f654fd47 |
| SHA256 | 48d0c9d1fdd2660d35e2af400d2940783b9e236855ffc6544308b20477c65795 |
| SHA512 | 4355e25a6eefe584c824f742764fd56111dd68d209e13071302862f65b40646afaa9e982872a9ea49fcb93aa2a75795f1de87c93bafab8efdec8ec8f60f3a84f |
/data/user/0/pl.spyone.agent2/databases/database.db
| MD5 | 0379f2b646309bcd59a19760005dd257 |
| SHA1 | 9185b00c3401321841b1c7edd10624a13c2dd47f |
| SHA256 | 62c0d663334435c7b56f7ef5ee45ef1e1476f9ef39ea6667dd48962eadb0216f |
| SHA512 | 387a118af4cd9315a8e5323b7a2b78e5214b0556448cdf6a68335ecda5615dfd0c1ca0313d8b355e8489980635319d90f2b7b25889b1e556c11b7657bc184fe8 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 55e0d42ff465430eeae5890f1693ed73 |
| SHA1 | bf109a60bd65a976b2e859d1142444556d8dc837 |
| SHA256 | c71915c5dfb7058dd14a7e908fa5140988d3119542b466d522418f4db78ce330 |
| SHA512 | d25e835dbde195465472e847750d8dc87cbca4f33ef14c7eff3832e833eeb22dbf3497a998ab6aff4ad442733def7c60ba7e61339d118abec395f99cf80ff00b |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 531fbd7ff93509462cba7950c465f4ef |
| SHA1 | 6abc410a58e8fb2d39d96d5b054b1116284263b4 |
| SHA256 | 4929cf2d40c3d5eb961afbaab2dbfabfaf57670fcf6e8d896fe260e3237d7af7 |
| SHA512 | 9807036a01f09d48a3f2c7c15e964e30b06e7c63a0194c1e2ab46f3473f64330d2a925b68aeaf5053d2999d3890561237a367dddeffd2267ce84e06d2db07a76 |