| URL: | efaxdocsteamworkspab71f7.myclickfunnels.com |
| Full analysis: | https://app.any.run/tasks/0311790e-73d0-4e27-bce6-dbf4390f6ebc |
| Verdict: | Malicious activity |
| Analysis date: | April 25, 2025, 17:21:31 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MD5: | 87D9287102A9532B0402FD5CCD535B00 |
| SHA1: | 42B2721F997B20E5CEC1229EC07143D3A13E8B94 |
| SHA256: | 448E8634EE2C0F3228E7EA18541AEA8AAA301EEB2C693FED7A301C0E82D17E6F |
| SSDEEP: | 3:m0BKGkuVytIn:mH/6 |
MALICIOUS
PHISHING has been detected (SURICATA)
- netd (PID: 345)
SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
126
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 345 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2217 | org.chromium.webview_shell | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2245 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2258 | webview_zygote | /system/bin/app_process32 | — | app_process32 |
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2296 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
12
DNS requests
9
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 172.217.16.195:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
2217 | app_process64 | GET | 301 | 172.64.152.44:80 | http://efaxdocsteamworkspab71f7.myclickfunnels.com/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
449 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 216.239.35.0:123 | time.android.com | — | — | whitelisted |
— | — | 172.217.16.195:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 142.250.186.68:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 108.177.127.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2296 | app_process32 | 142.250.185.131:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2245 | app_process32 | 216.58.206.35:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
2217 | app_process64 | 172.64.152.44:80 | efaxdocsteamworkspab71f7.myclickfunnels.com | CLOUDFLARENET | US | suspicious |
2296 | app_process32 | 142.250.186.142:443 | dl.google.com | GOOGLE | US | whitelisted |
2217 | app_process64 | 172.64.152.44:443 | efaxdocsteamworkspab71f7.myclickfunnels.com | — | — | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
efaxdocsteamworkspab71f7.myclickfunnels.com |
| unknown |
dl.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |
345 | netd | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Domain ( .myclickfunnels .com) |