Analysis
-
max time kernel
5s -
max time network
149s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system -
submitted
18-11-2024 10:42
Behavioral task
behavioral1
Sample
eblagh.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
eblagh.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
eblagh.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
eblagh.apk
-
Size
2.4MB
-
MD5
d19af56235d6c03a465f2095a86a6da3
-
SHA1
3e4fed9caa3f3eef68148f2519c42c1916dacd12
-
SHA256
bfaf5a89c27e0a1b7eafc47fb9c408d98a5214275168d72e2e9749b4e7aeb3cd
-
SHA512
f648b8b5770bf77f1b0f6aed59e8068737cd52fc491be5b31ff94528f4550111675b06c80269a0e51d912637041b28eaa17b9e87af6e14dbd96d617088bec6cc
-
SSDEEP
49152:5/iYJslyMdUVjtKuLm3crRnJOu5Ef8TPxs1fY7WYKI:h/Iy+CtKoNlDxsGCYn
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener mad.net -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock mad.net -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo mad.net -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone mad.net -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver mad.net -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo mad.net
Processes
Network
-
Remote address:1.1.1.1:53Requestssl.google-analytics.comIN AResponsessl.google-analytics.comIN A142.250.200.40
-
Remote address:1.1.1.1:53Requestmydaminhastmmd.irIN AResponsemydaminhastmmd.irIN A144.76.190.238
-
Remote address:144.76.190.238:443RequestPOST //me/Received.php HTTP/2.0
host: mydaminhastmmd.ir
content-type: application/x-www-form-urlencoded
content-length: 135
accept-encoding: gzip
user-agent: okhttp/2.4.0
ResponseHTTP/2.0 404
pragma: no-cache
content-type: text/html
content-length: 1251
date: Mon, 18 Nov 2024 10:42:17 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
-
Remote address:144.76.190.238:443RequestGET //me/link.txt HTTP/2.0
host: mydaminhastmmd.ir
accept-encoding: gzip
user-agent: okhttp/2.4.0
ResponseHTTP/2.0 404
pragma: no-cache
content-type: text/html
content-length: 1251
date: Mon, 18 Nov 2024 10:42:18 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A172.217.16.238
-
1.3kB 6.3kB 9 9
-
1.2kB 6.0kB 10 11
HTTP Request
POST https://mydaminhastmmd.ir//me/Received.phpHTTP Response
404 -
1.3kB 6.1kB 14 12
HTTP Request
GET https://mydaminhastmmd.ir//me/link.txtHTTP Response
404 -
1.2kB 40 B 1 1
-
6.4kB 10.1kB 23 25
-
1.3kB 40 B 5 1
-
8.8kB 11.1kB 28 27
-
520 B 10
-
520 B 10
-
3.7kB 11
-
70 B 86 B 1 1
DNS Request
ssl.google-analytics.com
DNS Response
142.250.200.40
-
63 B 79 B 1 1
DNS Request
mydaminhastmmd.ir
DNS Response
144.76.190.238
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
172.217.16.238
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
16KB
MD506b04dd52eb3c58a2913e4c57fe8f66e
SHA1a79fb36a882fbe8062f2c44bdb47e2173f6bfe0f
SHA25626a2b3453f8867962865bd557527bd2aac1f8a453bd5fbf6881503d2960cbda0
SHA5128d4cb599dbffee78036e5fc03de297b5c8a5c2bd9d6edfd9eee6b46da880c475eb6172a5a33a1511d21afddfe3a8b9efe0364fe4ee74422bf40b28405089376f
-
Filesize
16KB
MD54822e355aad4b538fb5e7a2a63de9e73
SHA1fc0beea9fac0286a517232e8c64247efee15583c
SHA256ae72f2f7ead65624b9f86d4e4d6a5e3d19718208492dba8b9bd5494f470c2cc0
SHA51227ea5b156e701b3099333e21fc86be2407bff8c69784a4b648ba1d5e8a3be2d72dc86ec51df7116d7d05b38accc30501de394999c7ff32e8ee959581df4fd885
-
Filesize
16KB
MD51277269065a0c66db6f1c0b4b091beac
SHA135d3c39b51f43a7abc2c690984f9b61d768c6488
SHA2560428f80eaa8884ba040f6b63725ca4226d5a711f500eb168eea3bda626db8a41
SHA5123b74bd862852e7a874c8b02c2c0fc7a4b47207b97f5a1874169848d103d15c86e30367a5443b77dcd7696889c9ad26d1b84bb77a25616f549cc3a0320a885b47
-
Filesize
16KB
MD52fd16f7111cdcb08de27f28cbcaf6cf7
SHA14237ae258fb9158c6ac200cd4b555951279abf84
SHA2568bfeff67fb77439eb677555010568de66e2a5d1e1effda9e6e3999e3f14dcfd2
SHA51226ae2460fa6d55d5aa9c251045c34f2efb1c5777409d0aed88e7f7e27ce765a1998ee4aec1a7b22f62b97147693553784f977ac7549319e6681c970cf81d771d
-
Filesize
16KB
MD5adf6082723784327d7d1b34adf974e7d
SHA1b1502f70eb881a1dfe41139cb719fefb877ee37c
SHA256252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9
SHA512762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b
-
Filesize
16KB
MD5eb52a90bb70b76e946b62f50b6f7fb85
SHA142d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA25648472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
SHA512b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
-
Filesize
4KB
MD5f1300c18cae999f8e7ebb7af00431e06
SHA168a76a3a96587c9c2eff0fa01c1a1c75f594b0a5
SHA256b409917975f97b14b3bb11550bd98b5db6802e08feacf929feacfe0e846c769a
SHA512933045ce2fa7f7050c27ea95ee648e7c9479046530f4fb4a44ec8f44632cb2af8f477210f6f4966ba069cb0bd757a90c9254009a1c8865cebf7e570ed5be677d
-
Filesize
8KB
MD5bfc52af324f6b7a270aac6eadf5131eb
SHA18d0ab27b9e95d5748afe465cf984a3fa2f6cfa7e
SHA25617322c59d4c418bc86fe3b2c40a72847cd2cfb54083c9bcd0d5e9b443036da81
SHA512c40375b1648ae3bd7d32e172f324748d6a2516a1a385373845023dad1b6b375793b0757e25f5737d963e86bb762539ab4a34311364ffe017779471b6856373ed
-
Filesize
8KB
MD57cf6a17f0a876faaa67172f69400fc04
SHA14856f6e117e6347cb51865796d19062c9b2200cd
SHA25609e2a0c6659aaad2b1d1ff5ddf443fbaa7f5985715b40fcfb0d5dd3dcc041816
SHA5122f79b6cea689474226483ea22cb1d194718d3f887bd5ace7bb9f520ea5dd80430d8165d40b5203d84c60de957fb79554012cfa86221b354beba6aa860173d9c5
-
Filesize
8KB
MD59cad73fff5cdc2368295fa1a64bcacec
SHA17946e0d5b9dbe28a7141a30ce9bba5935533e992
SHA256f6ffd15b1bc1b5714a1e6409804e99bf25cdaaddbbe36fa02f55202fdf9fac41
SHA512cde2985dce31fe7432d1dad0fa4256901872cdfe058f9b2ec457d4d123284f25750a4e9d7a1b69c72b00b2e560f52d38d8f0ef0adf734a3a75c8fbd1604e3770
-
Filesize
512B
MD54f291d396b4be43d98d858e6d9beb657
SHA18c1eeb08728fb7466f38524b23e8746d3b2922df
SHA2569164cf2667c232a448c0d65db3fcdd7c7858e50baba63e5ad5d0083deb67f601
SHA51279bc23086bfa9fc89351d023025763f09357372025583f4e10e69216c491ec886018406aff7a34a54843091e2d0b25afc7aeb8d14eeab45cbabcfda7fac48786
-
Filesize
8KB
MD513bb353e7a42e9e2858626158d37a0b3
SHA105b36b830d0008a04d06b71ef67bae532802fc5c
SHA2562590f38f192209978c8b9294b1a255180fa2923aa03e5bc52ab9e0be28bf0468
SHA5120b6ce010b4bc72ba114422b7dcf3fcb8064174c3e6bd849819530df4966350f0e332a3188f2d2c5bb4fee7f204260b16e950bb8307ac064f6f630c55c489c231
-
Filesize
570B
MD5a74741bfe1ec6e3326b9a0ce7b9a3102
SHA178c80b3b46b7b57da727cb259acb15676a0d1195
SHA256c70b25e17eb1e3b6941505030a0cf7b5fa5fb6407118ff2e753ac5b91219e208
SHA5124c1f815cc375a1f36ac41b4b5721095f1868931a6359f1119135d51f088eae41e8b10f34b17e985634eb00b882d5197b3a9a6a255107ac42f69b6d573492a66d
-
Filesize
90B
MD50cd8f8e5d5a4df39dcfae8c5f3f519b5
SHA1708766ea7feb49179c28f409794f7d31337bcebd
SHA256ad32db487314eeb2f1803d9a584c734d7c0dca04900d57e0bc8976038ef3d314
SHA512f18affffd4b8cec62961b6d685fc87c1d56faec2ea6345207fe291802b0958bd7ebe1ffd485cd6eb96507809d0024e17fad38e800b3bdd39e519bcf05a715a8d