hxxp://whatismyipaddress[.]com

Analysis

max time kernel
71s
max time network
77s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
15-07-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://whatismyipaddress.com

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	whatismyipaddress.com
9	whatismyipaddress.com
12	whatismyipaddress.com

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5039

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
274KB

MD5
5af18857bcdcc06f7ec8b8bd95a5a4e7

SHA1
c060ab27e90aa8d9c33aff37d848b88d05f51584

SHA256
8a60b3b56d3e8ad2b72e9c0431007a3c1bec1ea78857debafba0f5bda3c1727c

SHA512
e911ff2deb042c7567e84ab9d42c086b1cd9fab9e88ac08fd4cf56f62c4f057ccf5822aca755c96b32a18adec5e4e1f9d174ac46c24dc9e0730c985e44b95f9b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads