easylogger | 798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

Sharing

Copy URL Twitter E-mail

General

Target
798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae
Size 5.8MB
Sample240417-cdfbtaca81
SHA256 798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae
MD5 1398c9c6999be6f56f2364ec680f8557
SHA1 396c173b4c084afc3a2c89044ffa42a3f0e4dad4
SHA512 49ae3724b60f40ac3646a44164fd6879480d895e1096825f484d63d286b5c5b8f2557bdf752f746651504bd038bf9e93dfe7400977e2bd6ba24576843b3393dc
SSDEEP 98304:BUlRb+MDHwasxU19o7SDWNYbM2Wlghs4DqHvSse0EpO9X0xUCd7Mmp3/U5uaMA:CKhdU1xWlQDuSsGA9X097MaPUo/A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

easylogger

Malware Config

Extracted

Family

easylogger

https://pulsesolutions-net-easy-logger.firebaseio.com

Signatures

Easylogger family
easylogger

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

File Explorer

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

.apk 5.8MB

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

SHA256 798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae
MD5 1398c9c6999be6f56f2364ec680f8557
SHA1 396c173b4c084afc3a2c89044ffa42a3f0e4dad4
SHA512 49ae3724b60f40ac3646a44164fd6879480d895e1096825f484d63d286b5c5b8f2557bdf752f746651504bd038bf9e93dfe7400977e2bd6ba24576843b3393dc
SSDEEP 98304:BUlRb+MDHwasxU19o7SDWNYbM2Wlghs4DqHvSse0EpO9X0xUCd7Mmp3/U5uaMA:CKhdU1xWlQDuSsGA9X097MaPUo/A
MD5 SHA1 SHA512 SSDEEP

android

app.EasyLogger

app.EasyLogger.FallAlertWaitingActivity

app.EasyLogger.Splash

android.intent.action.MAIN

app.EasyLogger.Login

app.EasyLogger.ForgotPassword

app.EasyLogger.Settings

app.EasyLogger.DuplicateAppCheckActivity

app.EasyLogger.HideApp

app.EasyLogger.Help

app.EasyLogger.Upgrade

app.EasyLogger.SaveUpgradeResult

app.EasyLogger.PlanComparison

app.EasyLogger.TermsConditions

app.EasyLogger.About

app.EasyLogger.MapActivity

app.EasyLogger.WebViewDialogActivity

app.EasyLogger.GoogleLoginWebViewActivity

app.EasyLogger.GoogleRegisterWebViewActivity

app.EasyLogger.AlertPopup

app.EasyLogger.SendSOSAlertWaitingActivity

app.EasyLogger.SOSCallAndAlarmActivity

app.EasyLogger.EmailVerificationActivity

app.EasyLogger.VerificationCodeActivity

app.EasyLogger.CreatePasswordActivity

app.EasyLogger.LocationPermissionActivity

app.EasyLogger.LocationBackgroundPermissionActivity

com.google.android.libraries.places.widget.AutocompleteActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

app.EasyLogger.services.ApplicationWatcherServices

app.EasyLogger.services.NoiseDetectionService

app.EasyLogger.services.LocationTrackForFallandInactivity

app.EasyLogger.services.SpotLocationService

app.EasyLogger.GeofenceTransitionsIntentService

app.EasyLogger.services.UpdateSettingService

app.EasyLogger.services.PlaySoundService

app.EasyLogger.services.MotionDetectService

com.google.android.gms.analytics.AnalyticsService

com.google.android.gms.analytics.CampaignTrackingService

app.EasyLogger.firebase.MyFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

app.EasyLogger.firebase.MyFirebaseInstanceIDService

com.google.firebase.INSTANCE_ID_EVENT

app.EasyLogger.services.CallIntentService

app.EasyLogger.services.CallObserverTestService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.android.gms.analytics.AnalyticsJobService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

app.EasyLogger.receivers.AppAlarmReceiver

app.EasyLogger.receivers.BootCompletedReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT

app.EasyLogger.receivers.ShutDownReceiver

android.intent.action.ACTION_SHUTDOWN android.intent.action.QUICKBOOT_POWEROFF

app.EasyLogger.receivers.ConnectivityChangeReceiver

android.net.conn.CONNECTIVITY_CHANGE

app.EasyLogger.receivers.UninstallForceCloseReceiver

app.EasyLogger.receivers.OutgoingCallReceiver

android.intent.action.NEW_OUTGOING_CALL android.intent.action.PHONE_STATE

app.EasyLogger.receivers.GPSStatusReceiver

android.location.PROVIDERS_CHANGED

com.google.android.gms.analytics.AnalyticsReceiver

com.google.android.gms.analytics.ANALYTICS_DISPATCH

com.google.android.gms.analytics.CampaignTrackingReceiver

com.android.vending.INSTALL_REFERRER

app.EasyLogger.receivers.TimeZoneChangedReceiver

android.intent.action.TIMEZONE_CHANGED

app.EasyLogger.receivers.SimChangeReceiver

android.intent.action.SIM_STATE_CHANGED

app.EasyLogger.receivers.GeofenceReceiver

com.example.android.geofence.ACTION_RECEIVE_GEOFENCE

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CALL_PHONE

android.permission.READ_LOGS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_CALL_LOG

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.hardware.location.gps

android.permission.GET_ACCOUNTS

android.permission.GET_TASKS

android.permission.WAKE_LOCK

android.permission.GET_PACKAGE_SIZE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DISABLE_KEYGUARD

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.RECORD_AUDIO

android.permission.SYSTEM_ALERT_WINDOW

android.permission.PACKAGE_USAGE_STATS

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.BROADCAST_PACKAGE_ADDED

android.permission.BROADCAST_PACKAGE_REMOVED

android.permission.QUERY_ALL_PACKAGES

com.google.android.c2dm.permission.RECEIVE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.gms.permission.AD_ID