hxxp://whatismyipaddress[.]com

Analysis

max time kernel
68s
max time network
75s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
15/07/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://whatismyipaddress.com

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	whatismyipaddress.com
23	whatismyipaddress.com
27	whatismyipaddress.com

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4403

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
306KB

MD5
6ec1f2cbed91e2f443cffb25cb996620

SHA1
ea79bec3730590797eb41e2dd339b4bb9da2c8ef

SHA256
d66a209d33166f570c62ceeadf656bc9a59e397e917ea877e9bfa47c5f986377

SHA512
ac5cc8a852b9fa3c07f2d68616b3ed465698e68ba7ff342a4ffee63f4ee011d529d81513bcd028dba0871e34fb4d01725fca8efad2ed6ff47534f5f7ce335c8a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads