easylogger | 798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

Analysis

max time kernel
47s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
24-04-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae.apk
Size

5.8MB
MD5

1398c9c6999be6f56f2364ec680f8557
SHA1

396c173b4c084afc3a2c89044ffa42a3f0e4dad4
SHA256

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae
SHA512

49ae3724b60f40ac3646a44164fd6879480d895e1096825f484d63d286b5c5b8f2557bdf752f746651504bd038bf9e93dfe7400977e2bd6ba24576843b3393dc
SSDEEP

98304:BUlRb+MDHwasxU19o7SDWNYbM2Wlghs4DqHvSse0EpO9X0xUCd7Mmp3/U5uaMA:CKhdU1xWlQDuSsGA9X097MaPUo/A

Score

10^/10

easylogger banker collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

EasyLogger
EasyLogger is an Android stalkerware.
trojan infostealer spyware easylogger
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.EasyLogger

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	app.EasyLogger

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.EasyLogger

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.EasyLogger

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.EasyLogger

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

app.EasyLogger
1⤵
- Checks memory information
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4288

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/app.EasyLogger/cache/volley/-1201570017-1616341492

Filesize
1KB

MD5
853cd4da3ab8a3ca4bca3e0f011417f0

SHA1
d684305a48605b57ac4250b1341899672fb224ea

SHA256
d665338ee309d77207f63f321d263b34ba55d1d4470dad099d603c4b07fbd45f

SHA512
7f97e265faae811da05751de3b4ba6ce086dccab7633133b398535e6d02030ebe076eed4b2fa38e7ccc14f6044ef415c929d4540521fcbb2421455d4d7b8e838

Download Submit
/data/data/app.EasyLogger/cache/volley/-1201570017-1616341492

Filesize
1KB

MD5
7e7af548fb9169378fc6dc5214ec7ad7

SHA1
788534c1be2b0b8129f1433014b16a188e520c13

SHA256
edcdd65aed44e34d4db91edad1cf5e28d1e4c4c165e4767230e5881ff93e5945

SHA512
3bbb23362ae95ef53a0702a449c73c064d1ea354f268b009ac82113381c7cfe10764645d13f8df3ccacd6de6f3c7025f9fc3e314c73f9976fb5d19516d496f34

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db

Filesize
76KB

MD5
247a9a1ab8a9d50b768aea16f443ee52

SHA1
1b8ef45ad7df4db30e70051835585e526f7fe488

SHA256
6c414fa302b351eb7df14144c5c36a7ddd181615cb540f012ff67005837c9796

SHA512
6285e17579d1253b10f20e00f40aa8432e58a0e7b0b080c7ed52eafabae8f339f250897164409d1bc6512359557545998042fe41fca2e7b4ead85ab26918663f

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db-journal

Filesize
512B

MD5
1ee10c669ce1685e66937db36539b420

SHA1
19bbff7ff931da41985095f9be2fb17fbb675d10

SHA256
5e2e2a715ec29a712b73022b4cd7203d4927f7266187f48114f095b6baf33031

SHA512
275632ac2d18911028ff2a43901d948c6f5cd0f26f4ac5fe75140edfe52f7091c2d6874b6b2ac03fa6dc2b0328b1027e2f50a0ce338bd5991ded976840252095

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db-wal

Filesize
140KB

MD5
d5133fe1f9612665c31fea3fbe58bf45

SHA1
f101f47a705d670819912c872143bf6a2138dfac

SHA256
d2d5f94c6cc6a3844079c1a1680d9d48dcc4707f43cb39efffe979cd92dcb52c

SHA512
2ff8d33ce4a3036083a3015ffcad47221497f31d4375fa6594cb3099d1b5ef5f1f8b26c32623e901afa089b25c6cb44fabd846b88fd3025d4b2521741df0fd37

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
af4d12372ae166583a7699fdb855bdc1

SHA1
d59e8bc10324eb345822fef98b8a750657b28f9f

SHA256
626de472998ebbccbad8b03ecd6f1e4ce3587119c50100dd0eb8e0ffa4c82d58

SHA512
158a64fd522cb9f8e4b52a95b92c18681b7e916452107ad815940f517c76b5a8842a562ac10d6047be1cbc78b067740260ee8d748687ca5ae82f1cdd4c637556

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-wal

Filesize
52KB

MD5
b2a8828c0a88e382ce0e131202d793fe

SHA1
cb1e9f9c831932078fb91bf303753b3bb7a6a0e2

SHA256
b345aa67b8ed96ed06294eef92b34b0fa8a35997eeffadca240521020f645ffe

SHA512
9bd4c36869a73ea9b1f9f9208dd0e8f7f92bd6b1799f0b8de5f3f7d55b76d07edd0320ac0ac5fe2d532128ef7e596e21e089f88f3d8ec0984f410d964bce2c88

Download Submit
/data/data/app.EasyLogger/databases/google_analytics_v4.db-journal

Filesize
512B

MD5
913a98b5f31f522ff84cc033e97bc65d

SHA1
bb5284a881c69c2623419e20767a1ee8c631fddd

SHA256
bf94a42def78a8b913075623b18897e6625e8352904f67706917f6856354d029

SHA512
839a311e34af55fca99fd98758026f3c3c0d3de20b5f82536b9ae027faf1dedbf086c275ddfd0d2c9ba4beaf47e6937635c47770f24c284cc3556d22072e8ca6

Download Submit
/data/data/app.EasyLogger/databases/google_analytics_v4.db-wal

Filesize
68KB

MD5
ef94031437799001b0840335477a096f

SHA1
4258cc815bfadaa1dea57bc11de8af2b97012667

SHA256
d04cec130d9ff0a66222ca2395098423b1f936661d38f997e1a4bc4238194bd0

SHA512
e8f89035f1d2b5970ae7f694cfaf58776c0d1a68354b1b5af94c59999b75f64254cb8eb7180b441a30d3780fafb97e161ca562194d10d34b4e40072bec3c5f36

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d2fda36b757822d3f0d482e2d6081435

SHA1
1b60c1b22f15b3784392b7e0083c5f342c477fb7

SHA256
0626b7f83b1f9532a135233578ef772c176b577c04642a3ddde376f1a6a1e5b2

SHA512
9844139e1b0671dc5b66157b2862b4533676cd43c6739cc7bd092620756f1d42a5176039f3e7bba3dbad80be86b6f753525c2a76fcd6576363e19a88035b959a

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
501c92285a54e6167d5660641870a687

SHA1
c4ac2995a829ce83424f37a3282f734b2138a113

SHA256
870dfabffb9fbbd6cfec2e2c208ea8100b8025bbeb11f78c3e9927869f72c091

SHA512
8cf5630b33a744bdc59aad669c15c218dd109a62927915cb4ab9895afacd64331f874ded8d6f6f26e60643320e182315d6d6dc843eeecefb22b7a0f6d18c10d6

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
6b6d08809339d7c0244988067e444a2f

SHA1
e7fb753e8e201e77f97aac5e81aaab9f47cf32f7

SHA256
f16d313b2f5a338d0092a911100716eed2ffe683686b0f833c400dcdc499932f

SHA512
929dccbf0bf3a304fb02d35e645e95c3977570b061524752ccc3d09259dfbae699e425b454648f6a9c75ac3f081f603c3c55dbd0bbd4a1339757ef033d17bbf9

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
8180e9a36214cdb998ccd94b3a2dc12a

SHA1
d8ba9b70fadf4c05cbaaa5f2cf049e738b9f1976

SHA256
d1e94af870f1bea83d8b20f634d76d0716eaf542da6de7b6bb448a9623856830

SHA512
6b3fe0354e06970cb4186de8f72e2e43de91e8d935d4f310e0c491de549e2b6a4eac04088b47e0a563d402ea3b2c7231f676b64b4d3c85a3e802b3434451e99c

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
ade57a9892c105eb146676b760e41e1a

SHA1
4ae761adbe22de8b6979c1e3b6f9129ab8ff2c11

SHA256
273783621ede4e3a64953b0f7bf0d9fc8ea1d76a0d3d822f94f568a1d9a36eb6

SHA512
aeaf10d02cc568f8f5a09a713bbfd0ebe83d7fd2f66903bc8a64e75ff83d9e438fb937c2f76b5424e540b10f6260ca29477d8eb7370f35cb3ba74ddf7892d8fc

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
c3cd3a9763feddcc7d9ae4061e10a47b

SHA1
a3ede33de1fa342ceb3082d4d10c3f7649fdfc29

SHA256
27ce7fe54a77e6c1d57de7e11e2ece40b1e178f339ed680b9f72b2211f0ca251

SHA512
2ed2f3694f9ff5b4a0d27467500f0d84d5fa0d991a8ff97ace8671a768131665167c00e1ee5d8ff7ceae0925202fd5e61cca87dbd37f4b92b36bc9f1e665dc78

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
835273515ca5315ae518afdead910cdd

SHA1
088123af6d74d4159d2354da6f704a2d5f5b3346

SHA256
045482da17c12ab1b3b3fe90f925ab465b829f5740a1f59b9d305eaf5c6718ae

SHA512
07046cfaa41345f04e9c4f3ac37c47b4e322219d349ae98858ac2498ee05ea1ee9865508ddc781ae6c5ef5d619b516934779d4f2b7f5010b92ad60f67c5d3f90

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
37e127a15606ebb7f33454fead902207

SHA1
05be5f46d3410aa64b3f01bce9982f3bbbc038df

SHA256
c350d1ac40fd424fa17063abc352f074b88856c13e78096eacfb4ea0249fd551

SHA512
285e69860b710dcbc3a9e10fde3f3c3a34ee9a59df5b0311510125366fcc33d956771a994fa2af615ad071a098982f544fc3f5154946adea7bdc06d9819feaa0

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
fc340a0fc7b117615fb17950e2ad488f

SHA1
b255f7a9ead5f397d7f32caf7d1b07d0ba408e09

SHA256
1f81138f2e474cb3cac31bb50e4dc02282ce9641c16268621d7263d7194c99b7

SHA512
d6a2286cb2c8a1fb0148939281bbd2b5b89237fd8ab6d15b8f93ed3b741a8cefb03b4f7f20ff5f84663ae8862eb6b762ba89ee4910fb0f01fc9b52ca1abebc6f

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
0a967de320d052c6c5b94a6566ac0ddb

SHA1
12a6dead71140c3dfd4e0145b335d351d706d41b

SHA256
288c184f8086880def6ef7786081ac059b32f66e3e5b1301144473946158947b

SHA512
1da225aa773facab2ac0c841afdd60ae08a16dc953bd63e4a33c9cdf556429ee980aad188ce9348b67069c931436b48bda82d2c842b0cc22b9fb83a6fbb8b86c

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
d7729f3d2d67388b187efaaaf581b336

SHA1
a45eb3561e9cb0ccb3d6e441b3e746e9a891edac

SHA256
bbb6e2a2aef95ed6eafe85d10f6f818c8d04b2018aa4a8c2853f0dd6b7fc6538

SHA512
e28bc311fc6732d46de20b8aa5a906311a615701687aa2e51760e1c66adcc2ba814c1aba371a37fbda81ec00f78f472af9cc6b2d50876941d40443363581c101

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
132cb95152038b39fcefd2401abcf0de

SHA1
b401d98f275fd364ec5bd83093b2c0bcc21ced92

SHA256
aa671ed5131b2c56fe4c1e36133aa1f13e1b5570cb1b18b76933f39648725132

SHA512
f9b15c64b992a71053766d5427ffb87b2338a25edda558696a48595c8231d0839703691fde923109169c30821ec563e39c7c8475b8af178d44bd07ccabdd3734

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json

Filesize
710B

MD5
a39addbb7ec8b51e5f53de8d2e4051e7

SHA1
715e1b0fc36bb5b5eeb56910443d8fa90e0c54cd

SHA256
95c33a5ed036c2d30c15d99afe35285094f23a44b29e303675ac0bd36f8ab608

SHA512
d89969d3bcf79636fabe839c56e7d3fbb05b2542b1ba8b3fc91b9425d8072ada3fc22136656b7171dbf080c8ebbf9226d5102c2772e7f9bbe5db54eadfc55912

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-66286959004B000110C02B57C19DE9EA.temp

Filesize
438B

MD5
6432efce6aceb2649ef15d1cad04c1b9

SHA1
436ce6cb4bb592aaedb32148bcc8b2377c9cb030

SHA256
a3c749882cd95eb72b021021e514477b3cf624bdacd2df2b6e559bd9af479d95

SHA512
891b4bd80ac204dfa00f7671c9158f312fd445b66a29856fecf754461ef11f16d8828386ef6a45bf7cbf2a490121b1667b0ed0c50d1564a9a1dabf6d48170037

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-66286959004B000110C02B57C19DE9EA.temp.tmp

Filesize
16B

MD5
c33583fae4e0b61cde1c5b9227963237

SHA1
fe2ebe4d27469af1460f7e852031a04208ef629b

SHA256
35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

SHA512
fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/report-persistence/sessions/66286959004B000110C02B57C19DE9EA/report

Filesize
732B

MD5
53156a8c5455d6f56f50f80ec9124480

SHA1
979fc82434cc3b5cd305424bf98d113c51681a9d

SHA256
55eb648d1c09379f90ae84bf7400bb7da982715f862a43682597c7d0405a3609

SHA512
8f7093323fd896c761c0ba3be22ed542676d05f3b598e70e73ab89e4a8b4aa0efbc366375c2d6d77cb4ca62ac1c83ca8c775040163c53b67c369b14f805873fb

Download Submit
/data/data/app.EasyLogger/files/PersistedInstallation3428850403051570561tmp

Filesize
564B

MD5
10b49233234df09acb2d2440d89ecd1c

SHA1
46321418b26177596d583fd946771437a4e937fe

SHA256
6b3f7585ca36bc2742255ee097c962da91e4b73a693f7d87310ef5349c27a79d

SHA512
47139eba8a7779c1a36bb3c0048edebe9f13b4eaa4490414470da9165dcc8941ff734865137dd9d168656f3f82b8bf240880b9ea1e7dd9c744f125bbd7b16c44

Download Submit
/data/data/app.EasyLogger/files/PersistedInstallation6633524639778951024tmp

Filesize
90B

MD5
b2f257e05fd71d0920414798d20d734f

SHA1
da3ab714619fc6ffc26211367275fe7915269887

SHA256
63c120a8bd187545a3a4e2922f6e0cc319a585cbce269bcdfc99f4e14f8472b3

SHA512
4655b39a4edc51653c3be6cd40cc3e0df960af91c3b8ce913283523257e0b1598e40fa80dd21fadabe524f30fc4ce974a0cafb0d8bcb09e13f666755a1a7874d

Download Submit
/data/data/app.EasyLogger/files/gaClientId

Filesize
36B

MD5
04c6fdca4ce72de139f988cb8cf0cfe0

SHA1
cc55a986f2e4dd3c4cb59346869a67c940b02928

SHA256
8a8836ee20abbc0405b12b91070a7bb9bea1b4b40f8eca543979c90e8015a2b8

SHA512
dc7f30fecf3fdee133cea2422703ea4db966f542f0ebc3d9e16e14f62326f0adcc0eb76ea05d513adc8de1b61bb07bea5e23750abefaca64b00e6936fe401872

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ed10faee1987b9286c0022577448e2cb

SHA1
19e3d2dcf19cfc29391f6a766d29854d3ea4b589

SHA256
d347c7aabe2b9a450108a6f6482dc1f8f296eaf53a1bf7d2d8a631cd4961d812

SHA512
fa082b8d0766cfd0c3970703792c8c184d98a2059d6a05e5a6d5667992774263c83fcf76ccf52d431bef89385de3bd27cf281ac0d3562841a06294155ef28737

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
470136fce963be93eaf7b37c84ae6c17

SHA1
e5de8c622f2f57c9d2244aa822119e9071ce557d

SHA256
0a90892dc777670a1d9f8db65b7aa759124b4ed213687348eeaff4926a28f2f2

SHA512
db8884b1708a793b5a3e76697263dd0456119ffe533ac04c5af5893cb92a14f0ea4b6bdaae4dfcfcdcba464c467e70c2b3e476e2334db71a9e79ca3db54c1543

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
655a7ff2986911a78bdc0e42909d836e

SHA1
9f135da44d080c5e3b51407b6c650745e28489e9

SHA256
bde1f8117fd346d6c7c6b9f8b6f3cd98c15bdc1e8ed62875cfb66b43a4e5b3a7

SHA512
21c9e9af73f7d3a5e18fd596cb98a21c059b1292ed39aec8798a87d347fb2330990f460f73c07b9bb4b5978a28b91523eb27260e74c03fc6afd6a23a89ed655c

Download Submit