Analysis

  • max time kernel
    16s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    26-01-2025 02:37

General

  • Target

    92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk

  • Size

    3.6MB

  • MD5

    0366ae0abf0ada8aed90322bfe07dfd5

  • SHA1

    2f0779ce64f02944e87674745cb446c5bc620607

  • SHA256

    92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

  • SHA512

    52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677

  • SSDEEP

    98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc

Malware Config

Signatures

Processes

  • com.systemservice
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4258

Network

  • flag-au
    DNS
    semanticlocation-pa.googleapis.com
    Remote address:
    1.1.1.1:53
    Request
    semanticlocation-pa.googleapis.com
    IN A
    Response
    semanticlocation-pa.googleapis.com
    IN A
    142.250.179.234
    semanticlocation-pa.googleapis.com
    IN A
    216.58.213.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.201.106
    semanticlocation-pa.googleapis.com
    IN A
    142.250.180.10
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.10
    semanticlocation-pa.googleapis.com
    IN A
    216.58.204.74
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.234
    semanticlocation-pa.googleapis.com
    IN A
    172.217.169.10
    semanticlocation-pa.googleapis.com
    IN A
    142.250.187.202
    semanticlocation-pa.googleapis.com
    IN A
    172.217.16.234
    semanticlocation-pa.googleapis.com
    IN A
    142.250.200.42
    semanticlocation-pa.googleapis.com
    IN A
    142.250.178.10
  • flag-au
    DNS
    protocol-a100.phoneparental.com
    Remote address:
    1.1.1.1:53
    Request
    protocol-a100.phoneparental.com
    IN A
    Response
    protocol-a100.phoneparental.com
    IN A
    104.21.32.1
    protocol-a100.phoneparental.com
    IN A
    104.21.64.1
    protocol-a100.phoneparental.com
    IN A
    104.21.80.1
    protocol-a100.phoneparental.com
    IN A
    104.21.96.1
    protocol-a100.phoneparental.com
    IN A
    104.21.112.1
    protocol-a100.phoneparental.com
    IN A
    104.21.48.1
    protocol-a100.phoneparental.com
    IN A
    104.21.16.1
  • flag-us
    GET
    http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts
    Remote address:
    104.21.32.1:80
    Request
    GET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: protocol-a100.phoneparental.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Date: Sun, 26 Jan 2025 02:37:43 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: private
    Vary: Accept-Encoding
    Set-Cookie: ASP.NET_SessionId=afmozem10sewj51r410z0ble; path=/; HttpOnly; SameSite=Lax
    X-AspNetMvc-Version: 5.2
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rHw1TBmtb0Qdhj1aoWTZnfT2zYNpaYaM%2BFQWC445y4iTMvjb6u%2BuFpw1piV1cVYrR%2BRlPTnuchDYCegrdmKTo%2F6JQ4l2100qaqs1WmjOPJtvSWRr8g7fgYePIT%2BgWHTsbkCnN5azYMHkUzri4A5oectd"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 907d1f68c88f9482-LHR
    Content-Encoding: gzip
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=39095&min_rtt=39095&rtt_var=19547&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=227&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    GET
    http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts
    Remote address:
    104.21.32.1:80
    Request
    GET /protocols/get-brand-info.aspx?brand_info=tts HTTP/1.1
    User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; Pixel 2 Build/PSR1.180720.122)
    Host: protocol-a100.phoneparental.com
    Connection: Keep-Alive
    Accept-Encoding: gzip
    Response
    HTTP/1.1 200 OK
    Date: Sun, 26 Jan 2025 02:37:44 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: private
    Vary: Accept-Encoding
    Set-Cookie: ASP.NET_SessionId=ep4l5wuaepocboag5qzih0ui; path=/; HttpOnly; SameSite=Lax
    X-AspNetMvc-Version: 5.2
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fx6jYXzHCbok8o3c9eX%2F7clvuWXOH5EKJ8mf%2FHKgml4tHNG0DhudTfeuNdnWWbr65SRIOD5D1oNVc5OZBNamCynf3KwXtmnogJrywLlsGjBAckpi5Fpa8rNL07Y9TAszA9sCfTblDKNXgGtWG%2BRHMAAQ"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 907d1f737d779482-LHR
    Content-Encoding: gzip
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=39314&min_rtt=39095&rtt_var=8582&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1647&recv_bytes=454&delivery_rate=101224&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-au
    DNS
    android.apis.google.com
    Remote address:
    1.1.1.1:53
    Request
    android.apis.google.com
    IN A
    Response
    android.apis.google.com
    IN CNAME
    clients.l.google.com
    clients.l.google.com
    IN A
    172.217.169.46
  • 142.250.200.42:443
    tls, https
    202 B
    40 B
    1
    1
  • 104.21.32.1:80
    http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts
    http
    930 B
    3.8kB
    9
    9

    HTTP Request

    GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts

    HTTP Response

    200

    HTTP Request

    GET http://protocol-a100.phoneparental.com/protocols/get-brand-info.aspx?brand_info=tts

    HTTP Response

    200
  • 172.217.169.46:443
    android.apis.google.com
    tls
    5.9kB
    9.5kB
    16
    27
  • 224.0.0.251:5353
    3.8kB
    12
  • 1.1.1.1:53
    semanticlocation-pa.googleapis.com
    dns
    80 B
    288 B
    1
    1

    DNS Request

    semanticlocation-pa.googleapis.com

    DNS Response

    142.250.179.234
    216.58.213.10
    216.58.201.106
    142.250.180.10
    172.217.169.42
    142.250.200.10
    216.58.204.74
    142.250.187.234
    172.217.169.10
    142.250.187.202
    172.217.16.234
    142.250.200.42
    142.250.178.10

  • 1.1.1.1:53
    protocol-a100.phoneparental.com
    dns
    77 B
    189 B
    1
    1

    DNS Request

    protocol-a100.phoneparental.com

    DNS Response

    104.21.32.1
    104.21.64.1
    104.21.80.1
    104.21.96.1
    104.21.112.1
    104.21.48.1
    104.21.16.1

  • 1.1.1.1:53
    android.apis.google.com
    dns
    69 B
    109 B
    1
    1

    DNS Request

    android.apis.google.com

    DNS Response

    172.217.169.46

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    37979753db07f2d9e01b5eded10aea6a

    SHA1

    12444ee93cacf34c78eb24b100f88dd470498cee

    SHA256

    7a37b28002e4ac77787507f6a71176f1c694c54ee2f7b63e1787d8432d62255c

    SHA512

    53c5d07da02099f88db15db788aec30a38b2320acdbc9bf9f26ead7a2150b22ceceda95d8c40890de05a8a59951e805e302ae28a5fccd1db6365585b830d1287

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

    Filesize

    68KB

    MD5

    8e4f86ea58b9c3248750265eacf6157b

    SHA1

    11bcb8322b88cbda82409f87c0ebacdbd5c443bb

    SHA256

    5cd13baba0da521e09f44ccb56a67ef015db79afa003026389df72fb8294ede6

    SHA512

    43b132b2df8cc075e4df8d95e4021e7ed39cc1f6628129d9c44066ff1946d4ee0466cc069499d0c7312c8b9b98ac69ed85da9170086763c061fbd8ce73f64c13

  • /data/data/com.systemservice/databases/core.db

    Filesize

    36KB

    MD5

    045489a0639eee27bca52f48828cd93d

    SHA1

    436e7966e7c019273c44faa4d8c5709b816dfda3

    SHA256

    0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e

    SHA512

    c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    7237409e0640cfab7bdbd429bf821a3b

    SHA1

    4c3da934842f8d4835dfe2a9c275a300e5123309

    SHA256

    5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

    SHA512

    c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    f5f047809fa10b5f733c25b9024a727b

    SHA1

    e052d3551d5cc90dcfed29ff7536e9f1ddb9d160

    SHA256

    74ab55ef1e18feb40c7b8309a16edaa94e80712626361d6294314aeacac592cb

    SHA512

    38ab437324840eee33e76a99262152dfc1a0866dfe725fbdef4d5c29a7922727855a8ee751fc7054abd4c8dcde1d827f0f02552d70bc8aceb7acaa9632623eff

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    43d7de608d6010ab7de66449213894b5

    SHA1

    ab59c11f3cc0a24d3e4dfaba7df553fca603eb72

    SHA256

    0fe74b586d9f787e4eda2594bc0cc2a92d605e4639493950e8aef1e586888856

    SHA512

    148b9062b905087976b0746df090def79ecbd01ffd6c137124c32f938958471a57ce1537be8873370836465321698960fab19106de5acea7d8f97dfb16766ac3

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    db65863d18bc6209df5adbfecaa077a9

    SHA1

    90d69d4ebf210852ee6ea28929b94780a4ef360e

    SHA256

    e4ebf423d44c0f14d4a522697f318b971855e4daa6e47116a7dded0c68cf7378

    SHA512

    6642e44d9eb2c2349df40d34ddfcf556222d7028e89a6889085181a19b62f3c0f036b3ea04b08d796a3a1451f9851420b6c84492711ce9f7cae1d9ee6d40cfd3

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    bcebaa8d1ad578d6eb3d4619328fa77f

    SHA1

    90f2492c1bba2736bbf6cec51c2dfc6b42071238

    SHA256

    41a9cfdf0a1ade269831d584ff989b47b8b8423a5ef463a54e74eec44408bb56

    SHA512

    6b5f736ff2a8894cd66e0f0faa4900624bca0e591cdcbabbd8933f6b4825f4c06b6ad3fdaa6e83f3336c094e6510e3677ab7e91c703c50804a3332c4991643f2

  • /data/data/com.systemservice/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    835cfc7decf507cdc5e54f602e3f9699

    SHA1

    4a55d424cb32e766554672cb2d0b3804fc47552f

    SHA256

    29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852

    SHA512

    2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    5a75d2700feece86325d5771965c7fe6

    SHA1

    86b70253e62b8020a61e2496e435f20489042358

    SHA256

    2bac008cb1fd98ba6af5cf905c05d3c4f4de848b538a5dadc3fb97249b54f669

    SHA512

    ff1cfc39c144384caf4f6c59d1007f6943a80de031e85daf00a0dda7240e05b2ed2a45fbef85a805a1859bebaad6accefb08d90bd6eacb3591a34c65cf74c0f9

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-wal

    Filesize

    36KB

    MD5

    dca86664633650dad4953f5173ae2420

    SHA1

    f0969a3730d317134cdd5f1ad599bd4c2aac0f03

    SHA256

    357cc32faf7bd724812f797640b0fc244c6b200b15a43aa28b7e59504777b710

    SHA512

    910c34741272fce5bd5cef47b7ba82a8f4324d6d673a3408806298862fd95f564d849575fe0082d877c48c843cd9fe1d8ed4bfdd2ec27a5d50cc1b406abe6d49

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    5735bcd3e59d69f561d299e36e4a6637

    SHA1

    c906868005916f65e6bbf86e2ba51824bdabb766

    SHA256

    f64fe2114abc4b4039d8040d817bf1182336bbe860711ecfcfed2db360cb265a

    SHA512

    c46fb754b5736434637c45478271294c781d37063deafa844a12f22c82c556c3bc3ec751b82a351d259760d964f96528e4b8a9e2d70937912dbdada16704c23d

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    cef1ff5c51b1f11e0f92e546b1a12cbd

    SHA1

    db26e664487d1fc5a476e698897b61f37443302c

    SHA256

    1c9d2a69cef293a2d165bd80cbb3ca4e3d2c63da147ed3956338646bdcb57e42

    SHA512

    fed8595de3042b58cddfbf9a2172bd2d0a2b56521a0db9fa0cdfa5a2d78dc5b1965dae4ff5fe67b76dccb994ec6d4006816554481dac19336962375aba9137da

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    5857d220e5004ecaed0687ebc253ea8e

    SHA1

    6d451a42bee4c7a4f2201d98d51feed6c720d1ca

    SHA256

    ec7ca490d727602677a9836da39b650bc09e5c52cf9215f0a3b91707d5783625

    SHA512

    28c28f768ce6a53ae954e4c05db54b002b263369c1865502b0c2eb683c45b3ed4e360d84cee694c8a93e1b89150ed199d5526ab69ee8be854fc1daba29d69e3a

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    4d655bfecd40b0aadb7f12847a59d231

    SHA1

    a0df9d9edfb49f705f4e65d90d7ccbfd495968a3

    SHA256

    899283895c40c1fa977722867f3207380d9d9cf6fd79892ad1da491badab64ac

    SHA512

    4b6f11c27dde1ea4376607e956f12ed401489d563477fa322c80106a3975fd69e05052d65c70d206c0646034682a503ee887c3afbff71ec4a499bd6064ac9b14

  • /data/data/com.systemservice/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    71f1eb7a66e210d300b464000b42d38c

    SHA1

    3cd409b2c03edc66b25a91154e19ad29bafbb513

    SHA256

    34e6fa5f7b5fe264933695c3937cc7fbc3133941b85aa8d913405e254473040e

    SHA512

    b8ec732a81b203ef1f4121bda80418cd76ca308e11fcbd43b4d73d3a882b3a09b8c571182085aae4ddece8c128d5460c384aa94b602aa860f4b26180dcd249ad

  • /data/data/com.systemservice/files/PersistedInstallation6334810515848224965tmp

    Filesize

    90B

    MD5

    6b5ba0a68a1eed749f9b28af23950939

    SHA1

    f3372341feeb79365d6e6d0bc21766ab58eea34a

    SHA256

    05a07552de4780a1e160f00345a1f9327d3e17fbca4af7f8d463f64e84489293

    SHA512

    01740285280606463d752d0b856a57973d4235e87d319ba7f7c8c1a258d4ebab099cf8cb4443dabf608efe485c2a9fc44c7268fc09481c3fa322c386a4985fa4

  • /data/data/com.systemservice/files/PersistedInstallation725452599675043675tmp

    Filesize

    556B

    MD5

    f1d2747a845c7ed3118d64b571a089b0

    SHA1

    5202f7442fe7ba5cf795ec9a0bd2194678656bc5

    SHA256

    80ed9893dbc873cc4c8948b403436f9b4139082fd77b560566641f27d7728f1f

    SHA512

    ee3c358c6aacd7bec9afbaa59589669f29fba86ee7a7e3a2559e51e78af782f9e3d9887996397826c831852f51d01ee720866830b05f8f5f2a7074df9227c85d

  • /data/data/com.systemservice/log/log4j.txt

    Filesize

    3KB

    MD5

    55893405329c9ef2d1ccf9f7db6da87a

    SHA1

    9cd972f805acee52621d659047cfa19c82b8665e

    SHA256

    46cbfc720d9a86d67f8a0c343630c7787ed86c4b8c836442fd55b511c4228c6b

    SHA512

    689dcd8541deea58e23a62bfa54873bdf7a3fadbb35acba58ab820d04ff8ea49fa191a52e2aa0d99c452cf6c9bdf96a90b08d0ccd72c5edfd229dcd579e79d23

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.