Analysis

  • max time kernel
    18s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    02-10-2024 02:38

General

  • Target

    5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb.apk

  • Size

    3.6MB

  • MD5

    d836feab9d4bf3c6cf086bdc14724c8b

  • SHA1

    c837cf7b181679a0081165e5fe4aa0eb94f748f8

  • SHA256

    5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

  • SHA512

    8c7801c5f1d8dfda39e0c65bdbea83feb8f217b41b69a245d01dd9e983a6a357c8b0b2be79123bed07e638655fc66ef3a093cc01be68c696ecfea5ab6c692dad

  • SSDEEP

    98304:5s13ZL3Vf6JqeomaMDmQZ75ub8GoRJ6Odp/9hBbW+te6lXhAyHzwI:eTLVf6JumaMiQVWovl9jS+oS4I

Score
7/10

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs

Processes

  • com.systemservice
    1⤵
    • Acquires the wake lock
    • Queries information about active data network
    PID:4456

Network

  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    216.58.204.78
  • flag-us
    DNS
    protocol-a100.phoneparental.com
    Remote address:
    1.1.1.1:53
    Request
    protocol-a100.phoneparental.com
    IN A
    Response
    protocol-a100.phoneparental.com
    IN A
    104.21.47.58
    protocol-a100.phoneparental.com
    IN A
    172.67.144.220
  • flag-us
    GET
    http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts
    Remote address:
    104.21.47.58:80
    Request
    GET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 2 Build/RSR1.210722.013)
    Host: protocol-a100.phoneparental.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Date: Wed, 02 Oct 2024 02:39:08 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: private
    Vary: Accept-Encoding
    Set-Cookie: ASP.NET_SessionId=k1ezwze04xni4z3f2fktyai5; path=/; HttpOnly; SameSite=Lax
    X-AspNetMvc-Version: 5.2
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3q7ytRWF5zLtqpF66qM1s%2FMzI%2F%2Bk%2FLIx%2BnkX%2B2SpQN5w7gp4PzqMSCcOVdK6UsQQUYaObmuhSdWx6spCONiUwBm4C7pwcganZXWBW6xK1aRXgyT6HIRhUV7zG5LEvwbjq%2B72eIRRhJ8SST%2FVFwOT8bjW"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Speculation-Rules: "/cdn-cgi/speculation"
    Server: cloudflare
    CF-RAY: 8cc151fa491471ea-LHR
    Content-Encoding: gzip
  • flag-us
    GET
    http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts
    Remote address:
    104.21.47.58:80
    Request
    GET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 2 Build/RSR1.210722.013)
    Host: protocol-a100.phoneparental.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Date: Wed, 02 Oct 2024 02:39:09 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: private
    Vary: Accept-Encoding
    Set-Cookie: ASP.NET_SessionId=utrlwgsdwvxgmqoktka11rfc; path=/; HttpOnly; SameSite=Lax
    X-AspNetMvc-Version: 5.2
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yAdWiMKSUWdMNxBgPd7O%2Fz%2B1oBh8kPJyNmBKsDqvJ0dIgFDXCZb%2BJ92kSsv1nL5qR7iFx1o3UVEM2x0ebmYo0Sr6JLSnD1vfk0XSOtDGoSxdY5CGAH3k1%2FQlQoh3wk5whOQQVIUVwu0SyBaHotcfiocL"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Speculation-Rules: "/cdn-cgi/speculation"
    Server: cloudflare
    CF-RAY: 8cc152058e1a71ea-LHR
    Content-Encoding: gzip
  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    142.250.180.8
  • 142.250.180.14:443
    tls, https
    695 B
    40 B
    1
    1
  • 142.250.180.14:443
    tls, https
    695 B
    40 B
    1
    1
  • 142.250.180.14:443
    android.apis.google.com
    tls
    1.1kB
    4.4kB
    9
    6
  • 216.58.204.78:443
    android.apis.google.com
    tls
    7.0kB
    9.9kB
    28
    26
  • 216.58.204.78:443
    android.apis.google.com
    tls
    1.8kB
    5.9kB
    11
    11
  • 104.21.47.58:80
    http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts
    http
    1.0kB
    3.5kB
    11
    11

    HTTP Request

    GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts

    HTTP Response

    200

    HTTP Request

    GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts

    HTTP Response

    200
  • 142.250.180.8:443
    ssl.google-analytics.com
    tls
    1.3kB
    6.3kB
    8
    9
  • 142.250.200.36:443
    tls, https
    850 B
    40 B
    2
    1
  • 142.250.200.36:443
    www.google.com
    tls
    11.2kB
    11.6kB
    31
    39
  • 224.0.0.251:5353
    3.7kB
    11
  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    216.58.204.78

  • 1.1.1.1:53
    protocol-a100.phoneparental.com
    dns
    77 B
    109 B
    1
    1

    DNS Request

    protocol-a100.phoneparental.com

    DNS Response

    104.21.47.58
    172.67.144.220

  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
    86 B
    1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    142.250.180.8

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    7fb143869cfed90507c928c83b68e12a

    SHA1

    3f7e7b6437e7a4816d79c5dae0e5ee2c706fba9a

    SHA256

    4ab8240c63c4656ff3538cbfe8b325b16c0f799be642973fe5368f35cf0f9e7b

    SHA512

    b4542f56b40d6d5b1f3a38670180aef8d9c920116f7012a44b54b666a5d4ddd67b0f057458e44f9072fa951de043773176dca4efc6b84466bde57bd8036e0cea

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    99e6daab20c66f220ccfa80048d0688b

    SHA1

    77e0c1ec53263b801029b2e89709e4608830ff82

    SHA256

    c043a749cc5564f3640e8c4dabc757f9919c4bdb13509dc8ef0d99ed4790f603

    SHA512

    45d0712211e38feb7e5f6e3f1f6035f8f872cbf81cc7743603af1d359347bbd6f1c00cfba3e73295c7ab24576631c8eebcb0d819b8c5940cacbcc1cddfb1d9ac

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    d9d4ba2f5e2ad6fb3999e9005130eeb8

    SHA1

    d8f546f3df3ab60e710b0e06f6f68a9e338f338f

    SHA256

    a33ad052693ad1b44a8ed58041517d9fccf6d5c22692134d2d44802dec4b05ce

    SHA512

    62326d787735dd42104160cc2ea3b4dab5e9e0147936846a064ffea2df9dbb026ceb4b2de1b9cf1bf731422dc96f83bfdcff1a079b982448dce0fa1da0484679

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    63537bca26ffa0bfbd17aec0b8dc6ccd

    SHA1

    f16ced28641486bf56a47f102d2365393ce26720

    SHA256

    d7b519ad98958f75f9e60407ef6bfba84932f9b076cdfa416a4d59470acc35bf

    SHA512

    6f35c33db8fa4b08732c22cbffc358d3647f83a2c30ced5b7e0847b44f8e8ac835b32ecce4db9e582eb1276ce638e02dee28487c66bec0202c0389e386c9e283

  • /data/data/com.systemservice/databases/core.db

    Filesize

    36KB

    MD5

    045489a0639eee27bca52f48828cd93d

    SHA1

    436e7966e7c019273c44faa4d8c5709b816dfda3

    SHA256

    0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e

    SHA512

    c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    d9cf75fdd1c2292d986f6c3d5d60f2c8

    SHA1

    07ecb1d3a26d952ae5fecf54f36699ab498510b1

    SHA256

    2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

    SHA512

    442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    e2bb47c9438fcf07369a94fa56426ae1

    SHA1

    0084a776e30959ebb68b32e66e10c9196293356a

    SHA256

    2af896fe7978f565ec8692aedab0345ee8bede4a998db1795c37ad477b3ff2fe

    SHA512

    c3e13eb1adea2ef486574c414e994954f032df53b27cc5c5896e2e2d6ea772aa89eaf24fe7f7d28ebdddc5941cecf0d423f366a18cb23b256a9063e3cdd2f839

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    37527e0070f22683e7a4f20bbf1093d0

    SHA1

    3dd3442eb32e8998e71728538579b55521ade8d3

    SHA256

    96e5a54bd7c7534a5318dd03f91f6d46192c2b43004cca74a8f3dec7ff4032fc

    SHA512

    9679792233e68efd788b6ec8744f132e5420d0e7b21dbaca4ed2dd1b45007fd8ef25f0ec3f44a7a4ae885ab6dd6f77a351065bffd7ea5e966357b2f41d881786

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    690bc934254f6db1938d3392bc32a83a

    SHA1

    5c3fda2d4b6c192e1e91801f3f8f0419bda9a10d

    SHA256

    10fb8305eaebcec189f236818c0b074af0246a37ed990a816da486b0e86d4741

    SHA512

    7ff70d8ffe23d8ac6d7f8607de6052e47c9ab4423d7965e05c217403ff66987d496514cf27ab88f12f2ecaa6658962c59326a040801af8ac0a7d76ebb3db270e

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    af5109b26a6646d7d68df2247f3e7d02

    SHA1

    46ff3c61d9cd9907454141be112c16d91b034f34

    SHA256

    d5f81646ad20605e3deeed752612779c64b9e185563fc9b2cb3c984c498ee652

    SHA512

    a1428225de344ae7f151de983604a6de9d692eccaefe4fe6318a502f26366f7c785018a0a29452792ab6b17f5a3f7885e024fa6c42d239f6b721adb0c65ecbb9

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    2238195eab25764b61f2d26ef6a720af

    SHA1

    d366efd0cc079f0f87d23c630ec8d99f90541731

    SHA256

    599d63ed390f7e8e81d82b379c9a733ffbf454bfa5843bd0c909737c8d40dfef

    SHA512

    478111185428119bc92f0ffa3b6d88a7c644108c4b1d9b14a53bea1d74278bc78e67752e41d464dd81e3d600de8b7a723d0c7fa0ce920250ffd26977f9fa3470

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    b962634e6547404882ded2dd342c31c0

    SHA1

    b12906db7e3366a13f3a6dce4f08c7705cd42dcf

    SHA256

    1d6feba5535f965ea7713bab1eab45429663fde6d3e7e7031d1149bf79bca8e4

    SHA512

    52eae238cf28a6f13b4e13a0b33d87c3cf52ed272a5be84314c589cda13e659a533cb881823b9f66ac8d0fb5a8d7971845b18c13b107315ebbced6c8664fb2bf

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    4dee94142a86910e488c691353b9b358

    SHA1

    aed7b5cc78e1a71d75e42bbdd2fba08157c89634

    SHA256

    ac6ee506d6a93233f06272f70a0973333ab682c7282f10ea00a7693657430ba4

    SHA512

    1051cb2d4231185668f062f335f1fde5dc3ba32d052c865bb26e26cf4b91fec5d0300ba12d0c626f36a6157c6768600d14850182dac92db015d7603884e49c17

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    6d4d02c9b3ed86cf5bf60a742067417a

    SHA1

    a0357a3097bff13fceddbcf461ad9fcdeeff1bc5

    SHA256

    1b5b424aa1643b1a1fc9ff64cd3cd5a780878ba58bbd8b9f35d244a7e3398876

    SHA512

    832261f30dda31efcea211ccce7628dd908116abc791eddb2ad3a80e5850a7e4688b77a03556f50a003f12c6543a39239dcc8072de783420d0d6b4db73aa989f

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    9ad5bcdb42c5c20e6abf51ce41e1196f

    SHA1

    111c33c543312818e298661d6dd291e3d6b4d11a

    SHA256

    13f4b6ffce065e4b6ef5228b6e46784c617a57deebb40bdaad53ec21d9f62976

    SHA512

    e38663a13ddc9729d374529476c5cc96b4b3ce2626100b741fc92b8c2ab19e4992cb28dd963d041b239358694580082fbbaac7f8462228aa16604f25ce1d1c7f

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    b4ba38c8c48927e38e043a234e7b784c

    SHA1

    57b807df2856f7656905bfd858cd53e4f9cd80e1

    SHA256

    71f495d57a91012c8a7485d0f2a86c60ba2bfc1ad00204a47e9667f5270c663a

    SHA512

    f553ee8077c4fb5f5e0ec954212b87705d97097b77eb5bfe4ab347fa7209066620557a9683657ef6af2182bfe832844ed8d38b6fffc48f38e20bb61d8ceda3a6

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    2a38083300b53e18fee9fc84f1b221a6

    SHA1

    5abcd0e4f7db956481248ceefbf5de9f91f3a4de

    SHA256

    fbd0cde79ef75e03e68ce09bac4e26188c022389df7f4fd3a47410003b99e1a6

    SHA512

    8e130b9bab8b3af54e3a338ba6d38de8f4a2381cc25b1c33ebb5d97168b713e469b6578bff7d6ec780ae363c3915f9813e32a0803ebc4f008c42076754bed721

  • /data/data/com.systemservice/files/PersistedInstallation4560663880173115925tmp

    Filesize

    90B

    MD5

    b90ad341b40aadb0e65e3d874aed6e86

    SHA1

    9a80cac934ab5cc41cd026728d7578a883d7f043

    SHA256

    de6c9596a8a99d7ea1c6a8374b4be0e5d60c265846f75ddeb768ad2bb735f1cf

    SHA512

    b0fcb3e583cc623030c9e0ec2f738f3acbe7458a3b3a8716cfc160504082c09a789cc34a7939ab16b3ab23177c80769f7d0e4d474310f708814f90c6af86bba1

  • /data/data/com.systemservice/files/PersistedInstallation9027721944339904911tmp

    Filesize

    557B

    MD5

    760a2f70d0d9195cd18402291725eaa6

    SHA1

    b7112cd51185a35a34a5ac5bbb97cbca0fc372c8

    SHA256

    c17ae6f7c1b88969a4b0aaee14b73694470feb812e1102c7e804cd286e165cc9

    SHA512

    b02a04f1ea32f733708c354ed7e20e9a4a1999733f1969a20ad69f5d47c9a9dcf93e933b442fadbb27f0df6f1cc79c9fa4ec525e8bbb30e2f7a9bd54e50263b7

  • /data/data/com.systemservice/log/log4j.txt

    Filesize

    3KB

    MD5

    fa4f96d802705f9f071448ba8e8e2b15

    SHA1

    bc84ac7e91bbd79e8f9e4460b43f166bfa0247ff

    SHA256

    01c368c3658234f209a00f6a2b2d4a462a4db9b09553c9eedd51af1caaa0596f

    SHA512

    1652f29d01cd4f1b543bd16e2c950fbbf273d8c897ca05ccc87e9af042bcfbc0588e87507230221d9bfb2edaa17eab3d964833699a372fafdfb0d53f1b4e303c

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.