| URL: | https://keap.app/contact-us/6367691972021530 |
| Full analysis: | https://app.any.run/tasks/664212b5-00ae-4b95-9ac1-ef7b9aa6986d |
| Verdict: | Malicious activity |
| Analysis date: | April 29, 2025, 09:31:31 |
| OS: | Android 14 |
| Tags: | |
| Indicators: | |
| MD5: | 8A05EF3334C64A9AD3F5173DD918F135 |
| SHA1: | FE7D8D297681CBF2560ECDC591AF1953F2FFF9EA |
| SHA256: | 884724B07F9A177549EC3EBCB8E4B9305AE9ECF05FDE6F29121AB853E3008AB9 |
| SSDEEP: | 3:N8FKnZcOEQS:2cauS |
MALICIOUS
PHISHING has been detected (SURICATA)
- netd (PID: 345)
SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
127
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 345 | /system/bin/netd | /system/bin/netd | init | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2243 | org.chromium.webview_shell | /system/bin/app_process64 | app_process64 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2272 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2288 | webview_zygote | /system/bin/app_process32 | — | app_process32 |
User: webview_zygote Integrity Level: UNKNOWN Exit code: 0 | ||||
| 2323 | zygote | /system/bin/app_process32 | app_process32 | |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
41
DNS requests
23
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 216.58.212.163:80 | http://connectivitycheck.gstatic.com/generate_204 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
449 | mdnsd | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 216.239.35.12:123 | time.android.com | — | — | whitelisted |
— | — | 216.58.212.163:80 | connectivitycheck.gstatic.com | GOOGLE | US | whitelisted |
— | — | 142.250.186.68:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.251.31.81:443 | staging-remoteprovisioning.sandbox.googleapis.com | GOOGLE | US | whitelisted |
2243 | app_process64 | 151.101.1.195:443 | keap.app | FASTLY | US | unknown |
2272 | app_process32 | 216.58.206.35:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
2323 | app_process32 | 142.250.184.227:443 | update.googleapis.com | GOOGLE | US | whitelisted |
2323 | app_process32 | 142.250.186.46:443 | dl.google.com | GOOGLE | US | whitelisted |
2243 | app_process64 | 35.201.112.186:443 | edge.fullstory.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
connectivitycheck.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
time.android.com |
| whitelisted |
staging-remoteprovisioning.sandbox.googleapis.com |
| whitelisted |
google.com |
| whitelisted |
keap.app |
| unknown |
clientservices.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
dl.google.com |
| whitelisted |
edge.fullstory.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET INFO Android Device Connectivity Check |
345 | netd | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Domain (grmpimqnat .es) |