Analysis
-
max time kernel
18s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
02-10-2024 02:38
Behavioral task
behavioral1
Sample
5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb.apk
Resource
android-x86-arm-20240624-en
General
-
Target
5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb.apk
-
Size
3.6MB
-
MD5
d836feab9d4bf3c6cf086bdc14724c8b
-
SHA1
c837cf7b181679a0081165e5fe4aa0eb94f748f8
-
SHA256
5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
-
SHA512
8c7801c5f1d8dfda39e0c65bdbea83feb8f217b41b69a245d01dd9e983a6a357c8b0b2be79123bed07e638655fc66ef3a093cc01be68c696ecfea5ab6c692dad
-
SSDEEP
98304:5s13ZL3Vf6JqeomaMDmQZ75ub8GoRJ6Odp/9hBbW+te6lXhAyHzwI:eTLVf6JumaMiQVWovl9jS+oS4I
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.systemservice -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.systemservice
Processes
Network
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A216.58.204.78
-
Remote address:1.1.1.1:53Requestprotocol-a100.phoneparental.comIN AResponseprotocol-a100.phoneparental.comIN A104.21.47.58protocol-a100.phoneparental.comIN A172.67.144.220
-
Remote address:104.21.47.58:80RequestGET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 2 Build/RSR1.210722.013)
Host: protocol-a100.phoneparental.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private
Vary: Accept-Encoding
Set-Cookie: ASP.NET_SessionId=k1ezwze04xni4z3f2fktyai5; path=/; HttpOnly; SameSite=Lax
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3q7ytRWF5zLtqpF66qM1s%2FMzI%2F%2Bk%2FLIx%2BnkX%2B2SpQN5w7gp4PzqMSCcOVdK6UsQQUYaObmuhSdWx6spCONiUwBm4C7pwcganZXWBW6xK1aRXgyT6HIRhUV7zG5LEvwbjq%2B72eIRRhJ8SST%2FVFwOT8bjW"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 8cc151fa491471ea-LHR
Content-Encoding: gzip
-
Remote address:104.21.47.58:80RequestGET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 2 Build/RSR1.210722.013)
Host: protocol-a100.phoneparental.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private
Vary: Accept-Encoding
Set-Cookie: ASP.NET_SessionId=utrlwgsdwvxgmqoktka11rfc; path=/; HttpOnly; SameSite=Lax
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yAdWiMKSUWdMNxBgPd7O%2Fz%2B1oBh8kPJyNmBKsDqvJ0dIgFDXCZb%2BJ92kSsv1nL5qR7iFx1o3UVEM2x0ebmYo0Sr6JLSnD1vfk0XSOtDGoSxdY5CGAH3k1%2FQlQoh3wk5whOQQVIUVwu0SyBaHotcfiocL"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 8cc152058e1a71ea-LHR
Content-Encoding: gzip
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A142.250.180.8
-
695 B 40 B 1 1
-
695 B 40 B 1 1
-
1.1kB 4.4kB 9 6
-
7.0kB 9.9kB 28 26
-
1.8kB 5.9kB 11 11
-
104.21.47.58:80http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=ttshttp1.0kB 3.5kB 11 11
HTTP Request
GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=ttsHTTP Response
200HTTP Request
GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=ttsHTTP Response
200 -
1.3kB 6.3kB 8 9
-
850 B 40 B 2 1
-
11.2kB 11.6kB 31 39
-
3.7kB 11
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
216.58.204.78
-
77 B 109 B 1 1
DNS Request
protocol-a100.phoneparental.com
DNS Response
104.21.47.58172.67.144.220
-
70 B 86 B 1 1
DNS Request
ssl.google-analytics.com
DNS Response
142.250.180.8
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD57fb143869cfed90507c928c83b68e12a
SHA13f7e7b6437e7a4816d79c5dae0e5ee2c706fba9a
SHA2564ab8240c63c4656ff3538cbfe8b325b16c0f799be642973fe5368f35cf0f9e7b
SHA512b4542f56b40d6d5b1f3a38670180aef8d9c920116f7012a44b54b666a5d4ddd67b0f057458e44f9072fa951de043773176dca4efc6b84466bde57bd8036e0cea
-
Filesize
512B
MD599e6daab20c66f220ccfa80048d0688b
SHA177e0c1ec53263b801029b2e89709e4608830ff82
SHA256c043a749cc5564f3640e8c4dabc757f9919c4bdb13509dc8ef0d99ed4790f603
SHA51245d0712211e38feb7e5f6e3f1f6035f8f872cbf81cc7743603af1d359347bbd6f1c00cfba3e73295c7ab24576631c8eebcb0d819b8c5940cacbcc1cddfb1d9ac
-
Filesize
8KB
MD5d9d4ba2f5e2ad6fb3999e9005130eeb8
SHA1d8f546f3df3ab60e710b0e06f6f68a9e338f338f
SHA256a33ad052693ad1b44a8ed58041517d9fccf6d5c22692134d2d44802dec4b05ce
SHA51262326d787735dd42104160cc2ea3b4dab5e9e0147936846a064ffea2df9dbb026ceb4b2de1b9cf1bf731422dc96f83bfdcff1a079b982448dce0fa1da0484679
-
Filesize
8KB
MD563537bca26ffa0bfbd17aec0b8dc6ccd
SHA1f16ced28641486bf56a47f102d2365393ce26720
SHA256d7b519ad98958f75f9e60407ef6bfba84932f9b076cdfa416a4d59470acc35bf
SHA5126f35c33db8fa4b08732c22cbffc358d3647f83a2c30ced5b7e0847b44f8e8ac835b32ecce4db9e582eb1276ce638e02dee28487c66bec0202c0389e386c9e283
-
Filesize
36KB
MD5045489a0639eee27bca52f48828cd93d
SHA1436e7966e7c019273c44faa4d8c5709b816dfda3
SHA2560151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
-
Filesize
16KB
MD5d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA107ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA2562d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
SHA512442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
-
Filesize
16KB
MD5e2bb47c9438fcf07369a94fa56426ae1
SHA10084a776e30959ebb68b32e66e10c9196293356a
SHA2562af896fe7978f565ec8692aedab0345ee8bede4a998db1795c37ad477b3ff2fe
SHA512c3e13eb1adea2ef486574c414e994954f032df53b27cc5c5896e2e2d6ea772aa89eaf24fe7f7d28ebdddc5941cecf0d423f366a18cb23b256a9063e3cdd2f839
-
Filesize
16KB
MD537527e0070f22683e7a4f20bbf1093d0
SHA13dd3442eb32e8998e71728538579b55521ade8d3
SHA25696e5a54bd7c7534a5318dd03f91f6d46192c2b43004cca74a8f3dec7ff4032fc
SHA5129679792233e68efd788b6ec8744f132e5420d0e7b21dbaca4ed2dd1b45007fd8ef25f0ec3f44a7a4ae885ab6dd6f77a351065bffd7ea5e966357b2f41d881786
-
Filesize
16KB
MD5690bc934254f6db1938d3392bc32a83a
SHA15c3fda2d4b6c192e1e91801f3f8f0419bda9a10d
SHA25610fb8305eaebcec189f236818c0b074af0246a37ed990a816da486b0e86d4741
SHA5127ff70d8ffe23d8ac6d7f8607de6052e47c9ab4423d7965e05c217403ff66987d496514cf27ab88f12f2ecaa6658962c59326a040801af8ac0a7d76ebb3db270e
-
Filesize
16KB
MD5af5109b26a6646d7d68df2247f3e7d02
SHA146ff3c61d9cd9907454141be112c16d91b034f34
SHA256d5f81646ad20605e3deeed752612779c64b9e185563fc9b2cb3c984c498ee652
SHA512a1428225de344ae7f151de983604a6de9d692eccaefe4fe6318a502f26366f7c785018a0a29452792ab6b17f5a3f7885e024fa6c42d239f6b721adb0c65ecbb9
-
Filesize
16KB
MD52238195eab25764b61f2d26ef6a720af
SHA1d366efd0cc079f0f87d23c630ec8d99f90541731
SHA256599d63ed390f7e8e81d82b379c9a733ffbf454bfa5843bd0c909737c8d40dfef
SHA512478111185428119bc92f0ffa3b6d88a7c644108c4b1d9b14a53bea1d74278bc78e67752e41d464dd81e3d600de8b7a723d0c7fa0ce920250ffd26977f9fa3470
-
Filesize
512B
MD5b962634e6547404882ded2dd342c31c0
SHA1b12906db7e3366a13f3a6dce4f08c7705cd42dcf
SHA2561d6feba5535f965ea7713bab1eab45429663fde6d3e7e7031d1149bf79bca8e4
SHA51252eae238cf28a6f13b4e13a0b33d87c3cf52ed272a5be84314c589cda13e659a533cb881823b9f66ac8d0fb5a8d7971845b18c13b107315ebbced6c8664fb2bf
-
Filesize
8KB
MD54dee94142a86910e488c691353b9b358
SHA1aed7b5cc78e1a71d75e42bbdd2fba08157c89634
SHA256ac6ee506d6a93233f06272f70a0973333ab682c7282f10ea00a7693657430ba4
SHA5121051cb2d4231185668f062f335f1fde5dc3ba32d052c865bb26e26cf4b91fec5d0300ba12d0c626f36a6157c6768600d14850182dac92db015d7603884e49c17
-
Filesize
4KB
MD56d4d02c9b3ed86cf5bf60a742067417a
SHA1a0357a3097bff13fceddbcf461ad9fcdeeff1bc5
SHA2561b5b424aa1643b1a1fc9ff64cd3cd5a780878ba58bbd8b9f35d244a7e3398876
SHA512832261f30dda31efcea211ccce7628dd908116abc791eddb2ad3a80e5850a7e4688b77a03556f50a003f12c6543a39239dcc8072de783420d0d6b4db73aa989f
-
Filesize
8KB
MD59ad5bcdb42c5c20e6abf51ce41e1196f
SHA1111c33c543312818e298661d6dd291e3d6b4d11a
SHA25613f4b6ffce065e4b6ef5228b6e46784c617a57deebb40bdaad53ec21d9f62976
SHA512e38663a13ddc9729d374529476c5cc96b4b3ce2626100b741fc92b8c2ab19e4992cb28dd963d041b239358694580082fbbaac7f8462228aa16604f25ce1d1c7f
-
Filesize
8KB
MD5b4ba38c8c48927e38e043a234e7b784c
SHA157b807df2856f7656905bfd858cd53e4f9cd80e1
SHA25671f495d57a91012c8a7485d0f2a86c60ba2bfc1ad00204a47e9667f5270c663a
SHA512f553ee8077c4fb5f5e0ec954212b87705d97097b77eb5bfe4ab347fa7209066620557a9683657ef6af2182bfe832844ed8d38b6fffc48f38e20bb61d8ceda3a6
-
Filesize
8KB
MD52a38083300b53e18fee9fc84f1b221a6
SHA15abcd0e4f7db956481248ceefbf5de9f91f3a4de
SHA256fbd0cde79ef75e03e68ce09bac4e26188c022389df7f4fd3a47410003b99e1a6
SHA5128e130b9bab8b3af54e3a338ba6d38de8f4a2381cc25b1c33ebb5d97168b713e469b6578bff7d6ec780ae363c3915f9813e32a0803ebc4f008c42076754bed721
-
Filesize
90B
MD5b90ad341b40aadb0e65e3d874aed6e86
SHA19a80cac934ab5cc41cd026728d7578a883d7f043
SHA256de6c9596a8a99d7ea1c6a8374b4be0e5d60c265846f75ddeb768ad2bb735f1cf
SHA512b0fcb3e583cc623030c9e0ec2f738f3acbe7458a3b3a8716cfc160504082c09a789cc34a7939ab16b3ab23177c80769f7d0e4d474310f708814f90c6af86bba1
-
Filesize
557B
MD5760a2f70d0d9195cd18402291725eaa6
SHA1b7112cd51185a35a34a5ac5bbb97cbca0fc372c8
SHA256c17ae6f7c1b88969a4b0aaee14b73694470feb812e1102c7e804cd286e165cc9
SHA512b02a04f1ea32f733708c354ed7e20e9a4a1999733f1969a20ad69f5d47c9a9dcf93e933b442fadbb27f0df6f1cc79c9fa4ec525e8bbb30e2f7a9bd54e50263b7
-
Filesize
3KB
MD5fa4f96d802705f9f071448ba8e8e2b15
SHA1bc84ac7e91bbd79e8f9e4460b43f166bfa0247ff
SHA25601c368c3658234f209a00f6a2b2d4a462a4db9b09553c9eedd51af1caaa0596f
SHA5121652f29d01cd4f1b543bd16e2c950fbbf273d8c897ca05ccc87e9af042bcfbc0588e87507230221d9bfb2edaa17eab3d964833699a372fafdfb0d53f1b4e303c