Analysis Overview
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
Threat Level: Shows suspicious behavior
The file e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obtains sensitive information copied to the device clipboard
Queries the mobile country code (MCC)
Requests dangerous framework permissions
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks CPU information
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-15 02:30
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read SMS messages. | android.permission.READ_SMS | N/A | N/A |
| Allows an application to send SMS messages. | android.permission.SEND_SMS | N/A | N/A |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG | N/A | N/A |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-15 02:30
Reported
2024-06-15 02:33
Platform
android-x86-arm-20240611.1-en
Max time kernel
19s
Max time network
130s
Command Line
Signatures
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
| GB | 216.58.212.202:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 33fd1146fc8064e131abc96d9398ade3 |
| SHA1 | d56386dcf1218c6cb9c3b12d1ccc7be90700a154 |
| SHA256 | 5efe321c1e47138bda89d29b2f968815303e15fc177efe8d0f5c6a2d4c065605 |
| SHA512 | d3bb2779d21c372a767c8c4c64d7af482eab2c3d853b042b6200ea6788eb51eca82dc513706886b1edd0f5d4cb9a3ee8bcfb8a6991f999c84e0ac38677d63b9c |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/pl.spyone.agent2/databases/database.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/pl.spyone.agent2/databases/database.db-wal
| MD5 | cb0ecbbe38e54048622741a851f3b596 |
| SHA1 | 83e0edc7d789ba25bc71fb099c5007e3e78fadae |
| SHA256 | dbe78fe2d2e5336c7cd68ee065ec6a966c57f1a4bc7c959e2c33c5e01c70135b |
| SHA512 | 2cfa43efbdd55428e889430a1a68c4db995ce6dae9025106e199786c23765b02e18da2939fa908e9627cc46d5faa0d4c132b79a9ad3f7256534afc9bb4fb82b7 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-15 02:30
Reported
2024-06-15 02:33
Platform
android-x64-20240611.1-en
Max time kernel
49s
Max time network
131s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 216.58.204.72:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.204.78:443 | android.apis.google.com | tcp |
| GB | 216.58.212.238:443 | tcp | |
| GB | 142.250.200.2:443 | tcp | |
| GB | 172.217.169.68:443 | tcp | |
| GB | 172.217.169.68:443 | tcp | |
| GB | 142.250.200.46:443 | tcp |
Files
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | da7134f79bb7ced18eef13deca468847 |
| SHA1 | 58f57a50b661aea2add2094c2b5daf8318644a67 |
| SHA256 | 0d23a15c2efe8a23e82c2834b9303dc438351d01f5856e0e9b68e24d7dfc65ce |
| SHA512 | cafcbe5b33f1b3709091a7e24351ad1f8098ca1ead5337e1789f64c5f9b1d313ed4b2ec1955e5abd377a6be4ab7d635fb8c94a72feddd959442ccb309a3e039d |
/data/data/pl.spyone.agent2/databases/database.db
| MD5 | dd46d6cae176055d8617ceb3d40f1d96 |
| SHA1 | b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57 |
| SHA256 | c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96 |
| SHA512 | 54d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 18772624b4b79be3f3373c08e470de40 |
| SHA1 | a13fc6f589b4c96f9469d8faa06465a6f66b7e5d |
| SHA256 | 54291c60f41d90585f1f523670cf2a0d1ed1ce37dc27c8722a7478713ababef0 |
| SHA512 | 81b9d7925775548983ad9c56b55d9c061070796f1e1ebdf2f413e9222a2ca382fc4cd54ef3c4baf351cc0b5ed067ad0f9308031f909ca941ebf139787fe222f6 |
/data/data/pl.spyone.agent2/databases/database.db-journal
| MD5 | 654efa94f3e67b0896efbbdb96f109c6 |
| SHA1 | 27670b1b36123f41ea66788856b5875f881c0808 |
| SHA256 | 3889017ad7e7671dd00060ca9aeccca3e342305f8fa2a3d4a986e0864ec9453b |
| SHA512 | 5117ccb57ef207e531b4d9dab7f0c9c9b4c9b5313d20c170e461d8efacc686ceacb471ec7591566c791efaca736fa7caaa6a018305175017dc961f79938d9304 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-15 02:30
Reported
2024-06-15 02:33
Platform
android-x64-arm64-20240611.1-en
Max time kernel
19s
Max time network
132s
Command Line
Signatures
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Checks CPU information
| Description | Indicator | Process | Target |
| File opened for read | /proc/cpuinfo | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
pl.spyone.agent2
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.178.10:443 | tcp | |
| GB | 142.250.178.10:443 | tcp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 172.217.16.232:443 | ssl.google-analytics.com | tcp |
| GB | 172.217.16.238:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.238:443 | android.apis.google.com | tcp |
| GB | 216.58.201.100:443 | tcp | |
| GB | 216.58.201.100:443 | tcp |
Files
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 9a8adc00ebf635bb79221796329d7a7f |
| SHA1 | 89103d03c8e4c964a36d0eb34f0662818677391e |
| SHA256 | cc3024268a6fbc387d1a3cc0da2f566e31720417ac6a6e3e12341876e0e297b0 |
| SHA512 | 4e3baf3ab82951b8d2d4f46d3920c073397c3e0977833f58a03ce239293d932ed74120a5c26c4f1895083913dfdee0d333499d25dcd602702b4b8a661ef2697c |
/data/user/0/pl.spyone.agent2/databases/database.db
| MD5 | 0379f2b646309bcd59a19760005dd257 |
| SHA1 | 9185b00c3401321841b1c7edd10624a13c2dd47f |
| SHA256 | 62c0d663334435c7b56f7ef5ee45ef1e1476f9ef39ea6667dd48962eadb0216f |
| SHA512 | 387a118af4cd9315a8e5323b7a2b78e5214b0556448cdf6a68335ecda5615dfd0c1ca0313d8b355e8489980635319d90f2b7b25889b1e556c11b7657bc184fe8 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | cf868d8e605c632ab05a8c383a9d1cda |
| SHA1 | 59a81f21f2a3202d47ce6aa164f29babfd448af7 |
| SHA256 | 9096586432fb29a721603ba2b1f98bc83a078b9c6ca9682ce6c6d039be91761b |
| SHA512 | 7b7377b4d6cb89e4b683f97ce5558d9df782e5b03bd49a125d24fba4a4dbf6b0b0a4f4eca63308acc3d883e2c7c946f8db56890d6bdb6f8b5952b4a8924371d9 |
/data/user/0/pl.spyone.agent2/databases/database.db-journal
| MD5 | 13d48282f79093fe323f56b904adecbb |
| SHA1 | 9034770b706b2ba156364697face38a88640695a |
| SHA256 | b0750157d9f113b6004d70b143cf8bf8605ac5fdb47cee613411923fcaf97bdc |
| SHA512 | 67cdcb741b80d5f82ba871e73dfa030e2c59c55f2c42b7a0fc6d4af5455d6de3f563b6b16fc84fedf50e65e87766aa7a00db5d9eb4590f0965f4beb40fc5c9b3 |