Analysis
-
max time kernel
20s -
max time network
150s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
01-07-2024 02:18
General
-
Target
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8.apk
-
Size
2.0MB
-
MD5
71f6cdb3d8eebe1c8e7e26896238e571
-
SHA1
019134386a6d900d61285e5e986249928a9504b6
-
SHA256
e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8
-
SHA512
740e8bcde7462b99972ea472ee0cae53f4f61fcdc6d9ca1c8c44d0661323178c891f7fe82052cd7bae7239d7a953a6dcdb5e6fc42b28cd4acc9e1634e284228b
-
SSDEEP
49152:I8FjWz5Kzip37zl3fg1S1RvyzHth1mFI1/3Go1eiUMG1VummJwga8TGi3U/kX1l5:IIhup37zlviS1GHoFW3aiUM6ummJwgaE
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
pl.spyone.agent21⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/pl.spyone.agent2/databases/database.dbFilesize
76KB
MD5dd46d6cae176055d8617ceb3d40f1d96
SHA1b7a971b5f755f7fd5f9041bb1a0ffb1a74d9dd57
SHA256c4d2fc19a3c54c2d2cadde804546ce6f62f960865b829ea240026e1ea2706e96
SHA51254d353f7e746aa3935848cc2f694cd6cfbd1c59b6f56e276b76fad0f0a4c8ea09cd4835be8a8ccd615a7714d3e212a091d93a2b3b835f4ea767c8ba5950a5516
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
512B
MD556c8d55e03fa28c1cc6c5e72cfdcd131
SHA1cf50d26898f07865ed6243d18244afbeac533236
SHA25670c7aedac5442bc7403ac20984e64de7eb6af4aec6bdb1f6c4fb5ad839261311
SHA5128d0d11259749852bba496fd9e49ed9bc8595f231f2a49c933668ab874966dd5aa18c4a2aae661536a7a54f9742d64343bd983d10b39e5950174184ae6f9ad6e3
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD557d35b30db02ccaf1c8106c620188722
SHA1a9e6827d983bfde08cd1571d4ea1de0c655d10f2
SHA25625aba780e38f17684552e0050eca35f7a446e6281b4c197ddc69740a2e0dd857
SHA512ed5fee762e38fe1554709433129afb8a18bb844d1a215fac8576f674a9983c3391ec85bd57bdc24735e18ef89318e0a1ac3419fd8d194cd107c89d24fd744b7a
-
/data/data/pl.spyone.agent2/databases/database.db-journalFilesize
8KB
MD55b3e14cad0c2e2c618b5a93ed0e16f26
SHA17503547d4fe26e3edc4e60cefb4c7345c0b5325d
SHA25641dee5e7d4d58135502cf093b38c255d93b9268c5596590f0e3aa13e8eba9110
SHA512241821568d6db26e74e4f10413f2cf6a83b8eae589d8fd4e80fc14d9e974d6813d1c2e6cc99487dc1a13e947d5e1a13cea787483ed15e63c8920b9c970202d8d