| URL: | ey43.com |
| Full analysis: | https://app.any.run/tasks/bb4d3eb9-8fc1-4fb3-bcb7-b8bd68e1eef7 |
| Verdict: | Malicious activity |
| Analysis date: | June 01, 2025, 09:35:25 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MD5: | FF94041837C9E7C966BBB3D4700F5225 |
| SHA1: | 314AE9480163D5C9DE9AF75F0C1CB2F8AFEEAD6A |
| SHA256: | 3458E4C20E3EF96B4379C77D9770D9C241CF1C011B4BE0A5D9E1CE85830CFCCE |
| SSDEEP: | 3:5RMdI:Pz |
MALICIOUS
PHISHING has been detected (SURICATA)
- netd (PID: 345)
SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
127
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 345 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2225 | org.chromium.webview_shell | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2253 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2270 | webview_zygote | /system/bin/app_process32 | — | app_process32 |
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2305 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
9
DNS requests
9
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 142.250.185.99:80 | http://connectivitycheck.gstatic.com/generate_204 | US | — | — | whitelisted |
2225 | app_process64 | GET | 404 | 104.18.41.59:80 | http://ey43.com/ | unknown | html | 167 b | unknown |
2225 | app_process64 | GET | 204 | 104.18.41.59:80 | http://ey43.com/favicon.ico | unknown | compressed | 167 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 216.239.35.0:123 | time.android.com | — | — | whitelisted |
449 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 172.217.18.4:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.250.185.99:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 74.125.206.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2253 | app_process32 | 172.217.23.99:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
2225 | app_process64 | 104.18.41.59:80 | ey43.com | CLOUDFLARENET | — | shared |
2305 | app_process32 | 142.250.185.131:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2305 | app_process32 | 216.58.206.78:443 | dl.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.google.com |
| whitelisted |
connectivitycheck.gstatic.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
google.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
ey43.com |
| unknown |
update.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |
345 | netd | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Domain (ey43 .com) |