Analysis
-
max time kernel
49s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system -
submitted
15-06-2024 02:30
Static task
static1
Behavioral task
behavioral1
Sample
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
-
Size
2.0MB
-
MD5
71f6cdb3d8eebe1c8e7e26896238e571
-
SHA1
019134386a6d900d61285e5e986249928a9504b6
-
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
-
SHA512
740e8bcde7462b99972ea472ee0cae53f4f61fcdc6d9ca1c8c44d0661323178c891f7fe82052cd7bae7239d7a953a6dcdb5e6fc42b28cd4acc9e1634e284228b
-
SSDEEP
49152:I8FjWz5Kzip37zl3fg1S1RvyzHth1mFI1/3Go1eiUMG1VummJwga8TGi3U/kX1l5:IIhup37zlviS1GHoFW3aiUM6ummJwgaE
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
pl.spyone.agent2description ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone pl.spyone.agent2 -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
pl.spyone.agent2description ioc process Framework service call android.app.IActivityManager.registerReceiver pl.spyone.agent2 -
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/pl.spyone.agent2/databases/database.dbFilesize
76KB
MD5dd46d6cae176055d8617ceb3d40f1d96
SHA1b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57
SHA256c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96
SHA51254d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
512B
MD5da7134f79bb7ced18eef13deca468847
SHA158f57a50b661aea2add2094c2b5daf8318644a67
SHA2560d23a15c2efe8a23e82c2834b9303dc438351d01f5856e0e9b68e24d7dfc65ce
SHA512cafcbe5b33f1b3709091a7e24351ad1f8098ca1ead5337e1789f64c5f9b1d313ed4b2ec1955e5abd377a6be4ab7d635fb8c94a72feddd959442ccb309a3e039d
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD518772624b4b79be3f3373c08e470de40
SHA1a13fc6f589b4c96f9469d8faa06465a6f66b7e5d
SHA25654291c60f41d90585f1f523670cf2a0d1ed1ce37dc27c8722a7478713ababef0
SHA51281b9d7925775548983ad9c56b55d9c061070796f1e1ebdf2f413e9222a2ca382fc4cd54ef3c4baf351cc0b5ed067ad0f9308031f909ca941ebf139787fe222f6
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD5654efa94f3e67b0896efbbdb96f109c6
SHA127670b1b36123f41ea66788856b5875f881c0808
SHA2563889017ad7e7671dd00060ca9aeccca3e342305f8fa2a3d4a986e0864ec9453b
SHA5125117ccb57ef207e531b4d9dab7f0c9c9b4c9b5313d20c170e461d8efacc686ceacb471ec7591566c791efaca736fa7caaa6a018305175017dc961f79938d9304