Analysis
-
max time kernel
18s -
max time network
185s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
30-06-2024 02:29
General
-
Target
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
-
Size
2.0MB
-
MD5
71f6cdb3d8eebe1c8e7e26896238e571
-
SHA1
019134386a6d900d61285e5e986249928a9504b6
-
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
-
SHA512
740e8bcde7462b99972ea472ee0cae53f4f61fcdc6d9ca1c8c44d0661323178c891f7fe82052cd7bae7239d7a953a6dcdb5e6fc42b28cd4acc9e1634e284228b
-
SSDEEP
49152:I8FjWz5Kzip37zl3fg1S1RvyzHth1mFI1/3Go1eiUMG1VummJwga8TGi3U/kX1l5:IIhup37zlviS1GHoFW3aiUM6ummJwgaE
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
pl.spyone.agent21⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/pl.spyone.agent2/databases/database.dbFilesize
76KB
MD5dd46d6cae176055d8617ceb3d40f1d96
SHA1b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57
SHA256c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96
SHA51254d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
512B
MD58294095c7bede2924596d303bd8c0158
SHA1b432198a54a2068b1d99eafa9eb98179e98f1867
SHA256a6abc627479be48ea868c6c1245029746b537e62ea2ab0d60b611a4431ab9002
SHA5123dcea546317d3cb2a6e67cb9681b90ecb2faf6177c0ca1f5d4474679c910eec94c8e882089d384effd3bde5063a92e893d601b831fb0cc9d5583243644b69e14
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD59e5a91686e50c8713d2adcfa35afa88b
SHA12a5c4a9fcec71ea8b3c5486ad88c50104938f533
SHA2568d46094d22d73fcdc38aa73cef667f3040f8872f2f82e2baddbb6ca4ce5dc078
SHA512b07ba4a066ea5849221367635f9fc42dfae86d9a54966240444c31cfa1d03e90d01da12d68b5c93f8423c11ddb171dcff017092435ece3f157d75860d77732a2
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD5b2acf62bb01993b7a74bf9808654d0ad
SHA156464a3a3989fd7834ea6b48a719a55f0fda4333
SHA25667f77fe9e07683b068f85c30a033f814d9beb105654f9fe80df33d237f86e4f2
SHA51207842898632bccf36e235f4f091c2bda43f21680cec8b98eb351798834e57c7b59b1c39ea28768f094255e3a2153419905aabe8ae63cfda404353ab7960d4208