Analysis
-
max time kernel
16s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
26-01-2025 02:37
Behavioral task
behavioral1
Sample
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Resource
android-x64-20240910-en
General
-
Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
-
Size
3.6MB
-
MD5
0366ae0abf0ada8aed90322bfe07dfd5
-
SHA1
2f0779ce64f02944e87674745cb446c5bc620607
-
SHA256
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
-
SHA512
52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
-
SSDEEP
98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.systemservice -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.systemservice -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.systemservice -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.systemservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.systemservice
Processes
Network
-
Remote address:1.1.1.1:53Requestsemanticlocation-pa.googleapis.comIN AResponsesemanticlocation-pa.googleapis.comIN A142.250.179.234semanticlocation-pa.googleapis.comIN A216.58.213.10semanticlocation-pa.googleapis.comIN A216.58.201.106semanticlocation-pa.googleapis.comIN A142.250.180.10semanticlocation-pa.googleapis.comIN A172.217.169.42semanticlocation-pa.googleapis.comIN A142.250.200.10semanticlocation-pa.googleapis.comIN A216.58.204.74semanticlocation-pa.googleapis.comIN A142.250.187.234semanticlocation-pa.googleapis.comIN A172.217.169.10semanticlocation-pa.googleapis.comIN A142.250.187.202semanticlocation-pa.googleapis.comIN A172.217.16.234semanticlocation-pa.googleapis.comIN A142.250.200.42semanticlocation-pa.googleapis.comIN A142.250.178.10
-
Remote address:1.1.1.1:53Requestprotocol-a100.phoneparental.comIN AResponseprotocol-a100.phoneparental.comIN A104.21.32.1protocol-a100.phoneparental.comIN A104.21.64.1protocol-a100.phoneparental.comIN A104.21.80.1protocol-a100.phoneparental.comIN A104.21.96.1protocol-a100.phoneparental.comIN A104.21.112.1protocol-a100.phoneparental.comIN A104.21.48.1protocol-a100.phoneparental.comIN A104.21.16.1
-
Remote address:104.21.32.1:80RequestGET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: protocol-a100.phoneparental.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private
Vary: Accept-Encoding
Set-Cookie: ASP.NET_SessionId=afmozem10sewj51r410z0ble; path=/; HttpOnly; SameSite=Lax
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rHw1TBmtb0Qdhj1aoWTZnfT2zYNpaYaM%2BFQWC445y4iTMvjb6u%2BuFpw1piV1cVYrR%2BRlPTnuchDYCegrdmKTo%2F6JQ4l2100qaqs1WmjOPJtvSWRr8g7fgYePIT%2BgWHTsbkCnN5azYMHkUzri4A5oectd"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 907d1f68c88f9482-LHR
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=39095&min_rtt=39095&rtt_var=19547&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=227&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
-
Remote address:104.21.32.1:80RequestGET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
Host: protocol-a100.phoneparental.com
Connection: Keep-Alive
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private
Vary: Accept-Encoding
Set-Cookie: ASP.NET_SessionId=ep4l5wuaepocboag5qzih0ui; path=/; HttpOnly; SameSite=Lax
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fx6jYXzHCbok8o3c9eX%2F7clvuWXOH5EKJ8mf%2FHKgml4tHNG0DhudTfeuNdnWWbr65SRIOD5D1oNVc5OZBNamCynf3KwXtmnogJrywLlsGjBAckpi5Fpa8rNL07Y9TAszA9sCfTblDKNXgGtWG%2BRHMAAQ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 907d1f737d779482-LHR
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=39314&min_rtt=39095&rtt_var=8582&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1647&recv_bytes=454&delivery_rate=101224&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
-
Remote address:1.1.1.1:53Requestandroid.apis.google.comIN AResponseandroid.apis.google.comIN CNAMEclients.l.google.comclients.l.google.comIN A172.217.169.46
-
202 B 40 B 1 1
-
104.21.32.1:80http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=ttshttp930 B 3.8kB 9 9
HTTP Request
GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=ttsHTTP Response
200HTTP Request
GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=ttsHTTP Response
200 -
5.9kB 9.5kB 16 27
-
3.8kB 12
-
80 B 288 B 1 1
DNS Request
semanticlocation-pa.googleapis.com
DNS Response
142.250.179.234216.58.213.10216.58.201.106142.250.180.10172.217.169.42142.250.200.10216.58.204.74142.250.187.234172.217.169.10142.250.187.202172.217.16.234142.250.200.42142.250.178.10
-
77 B 189 B 1 1
DNS Request
protocol-a100.phoneparental.com
DNS Response
104.21.32.1104.21.64.1104.21.80.1104.21.96.1104.21.112.1104.21.48.1104.21.16.1
-
69 B 109 B 1 1
DNS Request
android.apis.google.com
DNS Response
172.217.169.46
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD537979753db07f2d9e01b5eded10aea6a
SHA112444ee93cacf34c78eb24b100f88dd470498cee
SHA2567a37b28002e4ac77787507f6a71176f1c694c54ee2f7b63e1787d8432d62255c
SHA51253c5d07da02099f88db15db788aec30a38b2320acdbc9bf9f26ead7a2150b22ceceda95d8c40890de05a8a59951e805e302ae28a5fccd1db6365585b830d1287
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD58e4f86ea58b9c3248750265eacf6157b
SHA111bcb8322b88cbda82409f87c0ebacdbd5c443bb
SHA2565cd13baba0da521e09f44ccb56a67ef015db79afa003026389df72fb8294ede6
SHA51243b132b2df8cc075e4df8d95e4021e7ed39cc1f6628129d9c44066ff1946d4ee0466cc069499d0c7312c8b9b98ac69ed85da9170086763c061fbd8ce73f64c13
-
Filesize
36KB
MD5045489a0639eee27bca52f48828cd93d
SHA1436e7966e7c019273c44faa4d8c5709b816dfda3
SHA2560151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD5f5f047809fa10b5f733c25b9024a727b
SHA1e052d3551d5cc90dcfed29ff7536e9f1ddb9d160
SHA25674ab55ef1e18feb40c7b8309a16edaa94e80712626361d6294314aeacac592cb
SHA51238ab437324840eee33e76a99262152dfc1a0866dfe725fbdef4d5c29a7922727855a8ee751fc7054abd4c8dcde1d827f0f02552d70bc8aceb7acaa9632623eff
-
Filesize
16KB
MD543d7de608d6010ab7de66449213894b5
SHA1ab59c11f3cc0a24d3e4dfaba7df553fca603eb72
SHA2560fe74b586d9f787e4eda2594bc0cc2a92d605e4639493950e8aef1e586888856
SHA512148b9062b905087976b0746df090def79ecbd01ffd6c137124c32f938958471a57ce1537be8873370836465321698960fab19106de5acea7d8f97dfb16766ac3
-
Filesize
16KB
MD5db65863d18bc6209df5adbfecaa077a9
SHA190d69d4ebf210852ee6ea28929b94780a4ef360e
SHA256e4ebf423d44c0f14d4a522697f318b971855e4daa6e47116a7dded0c68cf7378
SHA5126642e44d9eb2c2349df40d34ddfcf556222d7028e89a6889085181a19b62f3c0f036b3ea04b08d796a3a1451f9851420b6c84492711ce9f7cae1d9ee6d40cfd3
-
Filesize
16KB
MD5bcebaa8d1ad578d6eb3d4619328fa77f
SHA190f2492c1bba2736bbf6cec51c2dfc6b42071238
SHA25641a9cfdf0a1ade269831d584ff989b47b8b8423a5ef463a54e74eec44408bb56
SHA5126b5f736ff2a8894cd66e0f0faa4900624bca0e591cdcbabbd8933f6b4825f4c06b6ad3fdaa6e83f3336c094e6510e3677ab7e91c703c50804a3332c4991643f2
-
Filesize
16KB
MD5835cfc7decf507cdc5e54f602e3f9699
SHA14a55d424cb32e766554672cb2d0b3804fc47552f
SHA25629257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA5122ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d
-
Filesize
512B
MD55a75d2700feece86325d5771965c7fe6
SHA186b70253e62b8020a61e2496e435f20489042358
SHA2562bac008cb1fd98ba6af5cf905c05d3c4f4de848b538a5dadc3fb97249b54f669
SHA512ff1cfc39c144384caf4f6c59d1007f6943a80de031e85daf00a0dda7240e05b2ed2a45fbef85a805a1859bebaad6accefb08d90bd6eacb3591a34c65cf74c0f9
-
Filesize
36KB
MD5dca86664633650dad4953f5173ae2420
SHA1f0969a3730d317134cdd5f1ad599bd4c2aac0f03
SHA256357cc32faf7bd724812f797640b0fc244c6b200b15a43aa28b7e59504777b710
SHA512910c34741272fce5bd5cef47b7ba82a8f4324d6d673a3408806298862fd95f564d849575fe0082d877c48c843cd9fe1d8ed4bfdd2ec27a5d50cc1b406abe6d49
-
Filesize
4KB
MD55735bcd3e59d69f561d299e36e4a6637
SHA1c906868005916f65e6bbf86e2ba51824bdabb766
SHA256f64fe2114abc4b4039d8040d817bf1182336bbe860711ecfcfed2db360cb265a
SHA512c46fb754b5736434637c45478271294c781d37063deafa844a12f22c82c556c3bc3ec751b82a351d259760d964f96528e4b8a9e2d70937912dbdada16704c23d
-
Filesize
4KB
MD5cef1ff5c51b1f11e0f92e546b1a12cbd
SHA1db26e664487d1fc5a476e698897b61f37443302c
SHA2561c9d2a69cef293a2d165bd80cbb3ca4e3d2c63da147ed3956338646bdcb57e42
SHA512fed8595de3042b58cddfbf9a2172bd2d0a2b56521a0db9fa0cdfa5a2d78dc5b1965dae4ff5fe67b76dccb994ec6d4006816554481dac19336962375aba9137da
-
Filesize
4KB
MD55857d220e5004ecaed0687ebc253ea8e
SHA16d451a42bee4c7a4f2201d98d51feed6c720d1ca
SHA256ec7ca490d727602677a9836da39b650bc09e5c52cf9215f0a3b91707d5783625
SHA51228c28f768ce6a53ae954e4c05db54b002b263369c1865502b0c2eb683c45b3ed4e360d84cee694c8a93e1b89150ed199d5526ab69ee8be854fc1daba29d69e3a
-
Filesize
4KB
MD54d655bfecd40b0aadb7f12847a59d231
SHA1a0df9d9edfb49f705f4e65d90d7ccbfd495968a3
SHA256899283895c40c1fa977722867f3207380d9d9cf6fd79892ad1da491badab64ac
SHA5124b6f11c27dde1ea4376607e956f12ed401489d563477fa322c80106a3975fd69e05052d65c70d206c0646034682a503ee887c3afbff71ec4a499bd6064ac9b14
-
Filesize
4KB
MD571f1eb7a66e210d300b464000b42d38c
SHA13cd409b2c03edc66b25a91154e19ad29bafbb513
SHA25634e6fa5f7b5fe264933695c3937cc7fbc3133941b85aa8d913405e254473040e
SHA512b8ec732a81b203ef1f4121bda80418cd76ca308e11fcbd43b4d73d3a882b3a09b8c571182085aae4ddece8c128d5460c384aa94b602aa860f4b26180dcd249ad
-
Filesize
90B
MD56b5ba0a68a1eed749f9b28af23950939
SHA1f3372341feeb79365d6e6d0bc21766ab58eea34a
SHA25605a07552de4780a1e160f00345a1f9327d3e17fbca4af7f8d463f64e84489293
SHA51201740285280606463d752d0b856a57973d4235e87d319ba7f7c8c1a258d4ebab099cf8cb4443dabf608efe485c2a9fc44c7268fc09481c3fa322c386a4985fa4
-
Filesize
556B
MD5f1d2747a845c7ed3118d64b571a089b0
SHA15202f7442fe7ba5cf795ec9a0bd2194678656bc5
SHA25680ed9893dbc873cc4c8948b403436f9b4139082fd77b560566641f27d7728f1f
SHA512ee3c358c6aacd7bec9afbaa59589669f29fba86ee7a7e3a2559e51e78af782f9e3d9887996397826c831852f51d01ee720866830b05f8f5f2a7074df9227c85d
-
Filesize
3KB
MD555893405329c9ef2d1ccf9f7db6da87a
SHA19cd972f805acee52621d659047cfa19c82b8665e
SHA25646cbfc720d9a86d67f8a0c343630c7787ed86c4b8c836442fd55b511c4228c6b
SHA512689dcd8541deea58e23a62bfa54873bdf7a3fadbb35acba58ab820d04ff8ea49fa191a52e2aa0d99c452cf6c9bdf96a90b08d0ccd72c5edfd229dcd579e79d23