Analysis

  • max time kernel
    5s
  • max time network
    149s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    18-11-2024 10:42

General

  • Target

    eblagh.apk

  • Size

    2.4MB

  • MD5

    d19af56235d6c03a465f2095a86a6da3

  • SHA1

    3e4fed9caa3f3eef68148f2519c42c1916dacd12

  • SHA256

    bfaf5a89c27e0a1b7eafc47fb9c408d98a5214275168d72e2e9749b4e7aeb3cd

  • SHA512

    f648b8b5770bf77f1b0f6aed59e8068737cd52fc491be5b31ff94528f4550111675b06c80269a0e51d912637041b28eaa17b9e87af6e14dbd96d617088bec6cc

  • SSDEEP

    49152:5/iYJslyMdUVjtKuLm3crRnJOu5Ef8TPxs1fY7WYKI:h/Iy+CtKoNlDxsGCYn

Malware Config

Signatures

Processes

  • mad.net
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:4987

Network

  • flag-us
    DNS
    ssl.google-analytics.com
    Remote address:
    1.1.1.1:53
    Request
    ssl.google-analytics.com
    IN A
    Response
    ssl.google-analytics.com
    IN A
    142.250.200.40
  • flag-us
    DNS
    mydaminhastmmd.ir
    Remote address:
    1.1.1.1:53
    Request
    mydaminhastmmd.ir
    IN A
    Response
    mydaminhastmmd.ir
    IN A
    144.76.190.238
  • flag-de
    POST
    https://mydaminhastmmd.ir//me/Received.php
    Remote address:
    144.76.190.238:443
    Request
    POST //me/Received.php HTTP/2.0
    host: mydaminhastmmd.ir
    content-type: application/x-www-form-urlencoded
    content-length: 135
    accept-encoding: gzip
    user-agent: okhttp/2.4.0
    Response
    HTTP/2.0 404
    cache-control: private, no-cache, no-store, must-revalidate, max-age=0
    pragma: no-cache
    content-type: text/html
    content-length: 1251
    date: Mon, 18 Nov 2024 10:42:17 GMT
    server: LiteSpeed
    alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
  • flag-de
    GET
    https://mydaminhastmmd.ir//me/link.txt
    Remote address:
    144.76.190.238:443
    Request
    GET //me/link.txt HTTP/2.0
    host: mydaminhastmmd.ir
    accept-encoding: gzip
    user-agent: okhttp/2.4.0
    Response
    HTTP/2.0 404
    cache-control: private, no-cache, no-store, must-revalidate, max-age=0
    pragma: no-cache
    content-type: text/html
    content-length: 1251
    date: Mon, 18 Nov 2024 10:42:18 GMT
    server: LiteSpeed
    alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
  • flag-us
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    172.217.16.238
  • 142.250.200.40:443
    ssl.google-analytics.com
    tls
    1.3kB
    6.3kB
    9
    9
  • 144.76.190.238:443
    https://mydaminhastmmd.ir//me/Received.php
    tls, http2
    1.2kB
    6.0kB
    10
    11

    HTTP Request

    POST https://mydaminhastmmd.ir//me/Received.php

    HTTP Response

    404
  • 144.76.190.238:443
    https://mydaminhastmmd.ir//me/link.txt
    tls, http2
    1.3kB
    6.1kB
    14
    12

    HTTP Request

    GET https://mydaminhastmmd.ir//me/link.txt

    HTTP Response

    404
  • 142.250.200.46:443
    tls, https
    1.2kB
    40 B
    1
    1
  • 172.217.16.238:443
    android.apis.google.com
    tls
    6.4kB
    10.1kB
    23
    25
  • 142.250.187.228:443
    tls, https
    1.3kB
    40 B
    5
    1
  • 142.250.187.228:443
    www.google.com
    tls
    8.8kB
    11.1kB
    28
    27
  • 216.58.213.14:443
    520 B
    10
  • 142.250.178.2:443
    520 B
    10
  • 224.0.0.251:5353
    3.7kB
    11
  • 1.1.1.1:53
    ssl.google-analytics.com
    dns
    70 B
    86 B
    1
    1

    DNS Request

    ssl.google-analytics.com

    DNS Response

    142.250.200.40

  • 1.1.1.1:53
    mydaminhastmmd.ir
    dns
    63 B
    79 B
    1
    1

    DNS Request

    mydaminhastmmd.ir

    DNS Response

    144.76.190.238

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    172.217.16.238

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/mad.net/cache/~test.test

    Filesize

    4B

    MD5

    098f6bcd4621d373cade4e832627b4f6

    SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

    SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

    SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

  • /data/data/mad.net/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    06b04dd52eb3c58a2913e4c57fe8f66e

    SHA1

    a79fb36a882fbe8062f2c44bdb47e2173f6bfe0f

    SHA256

    26a2b3453f8867962865bd557527bd2aac1f8a453bd5fbf6881503d2960cbda0

    SHA512

    8d4cb599dbffee78036e5fc03de297b5c8a5c2bd9d6edfd9eee6b46da880c475eb6172a5a33a1511d21afddfe3a8b9efe0364fe4ee74422bf40b28405089376f

  • /data/data/mad.net/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    4822e355aad4b538fb5e7a2a63de9e73

    SHA1

    fc0beea9fac0286a517232e8c64247efee15583c

    SHA256

    ae72f2f7ead65624b9f86d4e4d6a5e3d19718208492dba8b9bd5494f470c2cc0

    SHA512

    27ea5b156e701b3099333e21fc86be2407bff8c69784a4b648ba1d5e8a3be2d72dc86ec51df7116d7d05b38accc30501de394999c7ff32e8ee959581df4fd885

  • /data/data/mad.net/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    1277269065a0c66db6f1c0b4b091beac

    SHA1

    35d3c39b51f43a7abc2c690984f9b61d768c6488

    SHA256

    0428f80eaa8884ba040f6b63725ca4226d5a711f500eb168eea3bda626db8a41

    SHA512

    3b74bd862852e7a874c8b02c2c0fc7a4b47207b97f5a1874169848d103d15c86e30367a5443b77dcd7696889c9ad26d1b84bb77a25616f549cc3a0320a885b47

  • /data/data/mad.net/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    2fd16f7111cdcb08de27f28cbcaf6cf7

    SHA1

    4237ae258fb9158c6ac200cd4b555951279abf84

    SHA256

    8bfeff67fb77439eb677555010568de66e2a5d1e1effda9e6e3999e3f14dcfd2

    SHA512

    26ae2460fa6d55d5aa9c251045c34f2efb1c5777409d0aed88e7f7e27ce765a1998ee4aec1a7b22f62b97147693553784f977ac7549319e6681c970cf81d771d

  • /data/data/mad.net/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    adf6082723784327d7d1b34adf974e7d

    SHA1

    b1502f70eb881a1dfe41139cb719fefb877ee37c

    SHA256

    252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

    SHA512

    762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

  • /data/data/mad.net/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    eb52a90bb70b76e946b62f50b6f7fb85

    SHA1

    42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

    SHA256

    48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

    SHA512

    b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

  • /data/data/mad.net/databases/google_app_measurement_local.db-journal

    Filesize

    4KB

    MD5

    f1300c18cae999f8e7ebb7af00431e06

    SHA1

    68a76a3a96587c9c2eff0fa01c1a1c75f594b0a5

    SHA256

    b409917975f97b14b3bb11550bd98b5db6802e08feacf929feacfe0e846c769a

    SHA512

    933045ce2fa7f7050c27ea95ee648e7c9479046530f4fb4a44ec8f44632cb2af8f477210f6f4966ba069cb0bd757a90c9254009a1c8865cebf7e570ed5be677d

  • /data/data/mad.net/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    bfc52af324f6b7a270aac6eadf5131eb

    SHA1

    8d0ab27b9e95d5748afe465cf984a3fa2f6cfa7e

    SHA256

    17322c59d4c418bc86fe3b2c40a72847cd2cfb54083c9bcd0d5e9b443036da81

    SHA512

    c40375b1648ae3bd7d32e172f324748d6a2516a1a385373845023dad1b6b375793b0757e25f5737d963e86bb762539ab4a34311364ffe017779471b6856373ed

  • /data/data/mad.net/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    7cf6a17f0a876faaa67172f69400fc04

    SHA1

    4856f6e117e6347cb51865796d19062c9b2200cd

    SHA256

    09e2a0c6659aaad2b1d1ff5ddf443fbaa7f5985715b40fcfb0d5dd3dcc041816

    SHA512

    2f79b6cea689474226483ea22cb1d194718d3f887bd5ace7bb9f520ea5dd80430d8165d40b5203d84c60de957fb79554012cfa86221b354beba6aa860173d9c5

  • /data/data/mad.net/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    9cad73fff5cdc2368295fa1a64bcacec

    SHA1

    7946e0d5b9dbe28a7141a30ce9bba5935533e992

    SHA256

    f6ffd15b1bc1b5714a1e6409804e99bf25cdaaddbbe36fa02f55202fdf9fac41

    SHA512

    cde2985dce31fe7432d1dad0fa4256901872cdfe058f9b2ec457d4d123284f25750a4e9d7a1b69c72b00b2e560f52d38d8f0ef0adf734a3a75c8fbd1604e3770

  • /data/data/mad.net/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    4f291d396b4be43d98d858e6d9beb657

    SHA1

    8c1eeb08728fb7466f38524b23e8746d3b2922df

    SHA256

    9164cf2667c232a448c0d65db3fcdd7c7858e50baba63e5ad5d0083deb67f601

    SHA512

    79bc23086bfa9fc89351d023025763f09357372025583f4e10e69216c491ec886018406aff7a34a54843091e2d0b25afc7aeb8d14eeab45cbabcfda7fac48786

  • /data/data/mad.net/databases/google_app_measurement_local.db-journal

    Filesize

    8KB

    MD5

    13bb353e7a42e9e2858626158d37a0b3

    SHA1

    05b36b830d0008a04d06b71ef67bae532802fc5c

    SHA256

    2590f38f192209978c8b9294b1a255180fa2923aa03e5bc52ab9e0be28bf0468

    SHA512

    0b6ce010b4bc72ba114422b7dcf3fcb8064174c3e6bd849819530df4966350f0e332a3188f2d2c5bb4fee7f204260b16e950bb8307ac064f6f630c55c489c231

  • /data/data/mad.net/files/PersistedInstallation2036814656890843161tmp

    Filesize

    570B

    MD5

    a74741bfe1ec6e3326b9a0ce7b9a3102

    SHA1

    78c80b3b46b7b57da727cb259acb15676a0d1195

    SHA256

    c70b25e17eb1e3b6941505030a0cf7b5fa5fb6407118ff2e753ac5b91219e208

    SHA512

    4c1f815cc375a1f36ac41b4b5721095f1868931a6359f1119135d51f088eae41e8b10f34b17e985634eb00b882d5197b3a9a6a255107ac42f69b6d573492a66d

  • /data/data/mad.net/files/PersistedInstallation4254173767341553132tmp

    Filesize

    90B

    MD5

    0cd8f8e5d5a4df39dcfae8c5f3f519b5

    SHA1

    708766ea7feb49179c28f409794f7d31337bcebd

    SHA256

    ad32db487314eeb2f1803d9a584c734d7c0dca04900d57e0bc8976038ef3d314

    SHA512

    f18affffd4b8cec62961b6d685fc87c1d56faec2ea6345207fe291802b0958bd7ebe1ffd485cd6eb96507809d0024e17fad38e800b3bdd39e519bcf05a715a8d

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.