easylogger | 798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
30-04-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae.apk
Size

5.8MB
MD5

1398c9c6999be6f56f2364ec680f8557
SHA1

396c173b4c084afc3a2c89044ffa42a3f0e4dad4
SHA256

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae
SHA512

49ae3724b60f40ac3646a44164fd6879480d895e1096825f484d63d286b5c5b8f2557bdf752f746651504bd038bf9e93dfe7400977e2bd6ba24576843b3393dc
SSDEEP

98304:BUlRb+MDHwasxU19o7SDWNYbM2Wlghs4DqHvSse0EpO9X0xUCd7Mmp3/U5uaMA:CKhdU1xWlQDuSsGA9X097MaPUo/A

Score

10^/10

easylogger banker collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

EasyLogger
EasyLogger is an Android stalkerware.
trojan infostealer spyware easylogger
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.EasyLogger

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	app.EasyLogger

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.EasyLogger

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.EasyLogger

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.EasyLogger

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

app.EasyLogger
1⤵
- Checks memory information
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4476

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/app.EasyLogger/cache/volley/-1201570017-1616341492

Filesize
1KB

MD5
96dfbc823ef688f5f7810be3cd2b2960

SHA1
4d9ec2bc3dd9d6058db6f7de687ee6e20483bb22

SHA256
56552998d7fc7d1b411362920be83e1245919348d631a41ff818826289266984

SHA512
79325bd7e6af6d2f83701c2236f0b7cd61622bdf5ca5b2abfc69d7287a4cc667f6fdb06044af84cc720257a540a60a50ac33a7f12b1a2ecc42032d290db9f0e4

Download Submit
/data/data/app.EasyLogger/cache/volley/-1201570017-1616341492

Filesize
1KB

MD5
9bec6bef4585e4bb494ab75a7462de0e

SHA1
1e616b0ff33a8af5962f00ebcf4ac8454cead6af

SHA256
631a144e074a78c31c4d8ae003363bf9da2677d9f87309cc042c0824e675a874

SHA512
d757120c440c1918e94a0b944f3bc81ba378cfd9185c40eeac64bc651b5927081db1637f1b46ee2cd98d5df60531ff4d32d940c98052ed0ddc2818fbfdc0d2d8

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db

Filesize
76KB

MD5
247a9a1ab8a9d50b768aea16f443ee52

SHA1
1b8ef45ad7df4db30e70051835585e526f7fe488

SHA256
6c414fa302b351eb7df14144c5c36a7ddd181615cb540f012ff67005837c9796

SHA512
6285e17579d1253b10f20e00f40aa8432e58a0e7b0b080c7ed52eafabae8f339f250897164409d1bc6512359557545998042fe41fca2e7b4ead85ab26918663f

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db-journal

Filesize
512B

MD5
63fd1d16161e34433868adf94f947831

SHA1
62e97537ad692c0b4a763f67c0a496d59e6c163b

SHA256
bad672be5b62c2400cd5a64f03b476be3da12386e29f84e49f11dc2fd63b1882

SHA512
d32552ffba2faaa644e51b36fd18b44075fe402e05ef81481e1b444d5c52151842960535c92a798ab970151473efa21c269001252de99e10b860b3addcc0c0af

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db-wal

Filesize
140KB

MD5
da56f4e16c91e2c8bb46d144537ad9aa

SHA1
98f5919b691d75f0862f3309ddfcc8296f7d9820

SHA256
801ea18bb69a8f3a34d3da94064cef2d5035359603a63c55d339fbc7f119b9b6

SHA512
4b922813fe07cf8825deec040cd4dadac5aa34a19dd9c602c17aab9809f03609c47a00be1b4461a14bdb222d7781f3f659a5ffed4228fd07708b02cc6806a3b3

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
dda0d7eccc6b25fd550d6d685eb90061

SHA1
7933c10d28870f14e554018949f7caea6142beb9

SHA256
9e142f9ae13598531db13dfc87364e33cbeb44440c18a5642f71c458d1676de1

SHA512
0305a8fe46ff373f1dc630227c5c2d21854608359cb27d7d33bfe1740930f1ed1d2612b6fdf9173db1e4fe2692392db0e2bd3d9c96aaa4864690c25eacef68d4

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-wal

Filesize
52KB

MD5
36d2bfcde42fd1f1104e646a266af2e0

SHA1
e30e9566c9edd15be9f51ad481f44ec097bd5ed4

SHA256
a3153803b9c3d98ca998c6fed14562393843fc371e042bae9b4b245b6745acdf

SHA512
befa21029ce446fb6f90af7ae5732fe296a55e3f1e43d8e85571f965a9d4fb76736a066a71ba4119ca60a8c46c2e2d30c296cf15ab51cc6717752a96b2683504

Download Submit
/data/data/app.EasyLogger/databases/google_analytics_v4.db-journal

Filesize
512B

MD5
9c4088cbf022d1a60eeaa28cba62abf2

SHA1
f3e066147dbcb62750f6292eba02b514cf50bdaa

SHA256
8031d8bd289893ce0142eca28b7c8ecb5ec7c1358732e203998b5dccab02dc7d

SHA512
c43a75b86cdf19925159466224955107b82027211818e75f9f678f8c0e81508601f2b9848da41de282c20ce323046668a6c3fbaf3ef69a8f2d0e31aaf8857d8d

Download Submit
/data/data/app.EasyLogger/databases/google_analytics_v4.db-wal

Filesize
68KB

MD5
e33ce3190f401d355cc1946dcd22f934

SHA1
93f81f1af81e5b2ec1944bc3bf9c07f0d935fd5b

SHA256
e099390be400d2bbb1b47ac8346133171159797e835459a1a2c3ce0c9078675b

SHA512
64969de7b35ca6997b66cabb3b8fe6c6457b417ec50bd2cacc3d48a89db9617e6a75998ea0266309f7236b1c84cdfda7d3ab5ac20b6f3ae1d3f2ac378529f1aa

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d03aa97b48633c1158a8e1021e60ae09

SHA1
625623f6edcfbb30d10234095bee287e3f3bc413

SHA256
77df0b7f7b94ca0526529d9084117fea9a08fea638d90acbc4c9da016d3b5032

SHA512
aff588123448fd41b34197710b025f97f141f9feec518444dc8cbb606e93af370c6f318eab5f6d3f41cbac4ff4aa5a21f2e7036d9169e76798e7e2651b296ad4

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
318655b834c2167a3a61ff830615c262

SHA1
bb78f9cb3ffb91700fdd69edbf0ae4ad57d1d8d7

SHA256
013e6d214c09145ee09a96adb7cd4975de0d0d0e87265c81677ab742a5a0b9d8

SHA512
3fa40be3df151e48e65a9339ff1185a84a0e1275d36c733fdc04d1f1cfc1c3a628092d98e582f434a40787e2fde3ae883ad8d4d1ab34eeb663211ea82f4b383a

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
79df7267ec00b14a3f334d88f5222c23

SHA1
fe4ba431b03b598df065a8c6441f7337cefa17da

SHA256
47933021e27d3831e2bc515aedafff7d8f5512ccbcc5eceaa71f34ffaef7d652

SHA512
f2a9014c2337fe3a8da5b267d5a9cf98a2d72de7caf117069cc565ae20a531aa86f9412a1730870471c80a8ed2bca361f36b60cd689997bd14851c9a63a13643

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
e5b3628d07ca5487ee861862e8b14cf1

SHA1
e990051d88b102a02158f80d1b427a87eb2161ba

SHA256
cb4c6bf39f8c3a2e9bb1af08dca2450c6fe8c38e8515dc2780d01516dc8afa63

SHA512
998214ff3dc0aa3ce16c2cba7d3da499b6e4955d4c1214113462cf076f2bb8ba25866d5b704433fe495810bd207cf2f71883a6e06a739402c0dd988b6e7ea279

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
87cb9139596742358c3c3c255a7eb83d

SHA1
4c828cd7ecb820c49388be23f7044752b2a799a5

SHA256
3efa205c621cf97960f5c1b691931bf0b983ceeebbf1833b6fa0f9b1391a1593

SHA512
7edce5c507f0c3efad1c9fbc7da751a2b11de32fb23e52f21d18cea525e1172ffcdf71198884a0a5c88d84e3268d8125815fe88f78743d9a2b2fb4982a841b2a

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
54d1a687d1ddccfa6ca2888e667f6ea0

SHA1
0be7069b82403608768ea84dd9c991c15282b6ae

SHA256
a30f19f830c69384c040bed7b4288f10c69883ba2ed1f945517648f94fd86a9d

SHA512
10ad03a044e98eefbf5f07d483a1f2142364dd9ab6805f96e900303e23a59982816dba43cf9009bdf864c1f0a6c3e2a944db32af096d2f840f82dce23258e0ca

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
3b12f9330a6f3e1b2a381d214773e04e

SHA1
7d251bf0bbacc1900effaee6184d2b076df4f213

SHA256
97f81caf9be76d3351712722ac8768151e20a558eeb3255f86d72f02f3fd70a2

SHA512
35289d8abaa5a820106d49ede9fa3d4673fcf3264daaa3c90dd9663138e3e2b7fdbff77b8e582225017807520c1b8e88e614ee71893e37441d529627a3436cc4

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
821be5be7bbf358f4b0f33a5afc148c0

SHA1
1c13119e9c545623e69d35a56a7d542ea60bf411

SHA256
8aa3ca03207c2eb0b3b8a530414dec095aa840afb51d0a786a069bf9edf3b648

SHA512
0708774110988c3e8e7ab28afdb32920e1a1eb3fe178d156f0df178155d1818c9a0b61ea3b6f3a34b28ddd27680f084e848a6b6f737b64ea1a0c333811d7a208

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
f257533a337c06f044d4bc0d82faccf8

SHA1
316569b86bdb537b1fc0016601fbd0a7a716fcf0

SHA256
a9b6b3f189cc3bd1ec1dbd457a9ae73e5751986651c6c352aa2ec6a891e21654

SHA512
abe4dd2d32102a03209819487dba51c82021dfe98854922151122095970dc63c6d60b66e66a5176848eb477041158f35850414dd3c89218ee10fc17803106df2

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
0ef9a91600aec9345053261287d3f052

SHA1
8087bfcd6c34fb2398a0f93b79c8ac21a58c45d0

SHA256
0a8de4cca960eb42872b1b27267293a257b3916bc1aaa99071a136085ca99aa8

SHA512
68920e35922808d1d9d39440fc82674e12ff7e8f6e23cdcc131f6e0ccbac441c70313eeba2e5c4ce7c3597fed7ae257d72363ed1a5495895becf5c533b2893b9

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
122d1482718d6b8f6111e014748c8f9c

SHA1
12882610eb339658c97287e2540c05c8c79ded0d

SHA256
ccf7559411ce1b1a21a32f443581cb81a7d451f169b8f2c80c99c879661994aa

SHA512
4bcf282e203a050228aa0bad24cd4acc567eb4d2ccac91b65e7baf0eafceeb80986451a48556248261672789851a4afa9cbc67de8910511cd860ca575772fa7c

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
42b3ee8b13a0b3a0a25bbda7b432d344

SHA1
a22910acaea7dc0892238254c5ed79b44683fd8b

SHA256
b6e70feb0bc08bf26ba143438f9232519142f9f9a10553f69759d1f1c0b1e2bf

SHA512
8b87381c6aaf2c2f5bbd9a55d6bffb1572550c43e26b3101e5a7366b8df1ddcb711a5eae364edfb2faca70b615362e1340c071c87f4d937bf5959ec4bbf49b56

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json

Filesize
710B

MD5
a24616ac425ad7b4cbd05d65fd1bfee9

SHA1
d4a79c984db84977a0092d62ae1356ceedd8b765

SHA256
2404afdb4aa61259b61491ce94e0cade117f0bfd010158408180055d9a8a4fb3

SHA512
4b5ccb16fe21a8812c6425feaac496ade00d70457c52fedbf20a5c4377dbeacbd9ca900b1290d35b104290ae7f70422d4c3162a4febb058ebee60d640e2c129f

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-663052FD03C00001117C50AB380920C3.temp

Filesize
438B

MD5
55790918da791af6b0e9875c667887f2

SHA1
daed618dd96bab16c49e841770d0e58c81b5494a

SHA256
e3a2e42e1323a90c9a89ce671107865190ef693f4317f16f97ee0c18f294ad87

SHA512
97cb6ec4a060bd00288465201649c0e41eab21869d5646f6c81ff8b8c232ab422acdb36d4241e7565bdd59cb9362df783e65a25e6a64731de6b0cc37d2785ec6

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-663052FD03C00001117C50AB380920C3.temp.tmp

Filesize
16B

MD5
c33583fae4e0b61cde1c5b9227963237

SHA1
fe2ebe4d27469af1460f7e852031a04208ef629b

SHA256
35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

SHA512
fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/report-persistence/sessions/663052FD03C00001117C50AB380920C3/report

Filesize
732B

MD5
aeaafb4965938397ba0f3f8553964130

SHA1
43ae5cd3723259fb2a881d6ba1d4986da39190b6

SHA256
9e9d4bbfdfc2e89cc25385efad77d1538601aad098b7bfa2b7656210631e92be

SHA512
b2b04a8dd6db58dd3860007fd15f7ff5271c7307a4e904806e63862b5cf3b47e120f7cbff5d65ba75ea9ea6bfb391cc5840de70355e1c8df55488ac078b4bbb9

Download Submit
/data/data/app.EasyLogger/files/PersistedInstallation1976479107041586951tmp

Filesize
90B

MD5
fe6a3ec9c0dd17bc258652a78d11afd4

SHA1
277ffae7bd70d5384e9406dc95666a601e89a3aa

SHA256
bba77a01773f9b93e5252636e70d17f1aab01913415f9757eccb3bb95189de17

SHA512
d0d1b93059629966a1b692a552dc70a898130f681b815f212cd3d4f128641052c4e5e87acda114176830d9601e9d75ca510cdfe13765ef478848ba0744ffe79e

Download Submit
/data/data/app.EasyLogger/files/PersistedInstallation6453829586512744123tmp

Filesize
565B

MD5
acd674ec95cc1fe9ed819188a11a6fcb

SHA1
89c1c1ce061572be184fad1d34e82724871cb557

SHA256
581beb4de3883458c2fd09f94356aa1af64dd3fad4aa0a32349db77d0dd5b517

SHA512
3027299ce1fd30d3aaebd68cd928e02ef90492c841afef024ff16bad861a93ce1ecf125016a164a174bc9151bfca5b3ab71245508298be9cdf42b42f25ec5a26

Download Submit
/data/data/app.EasyLogger/files/gaClientId

Filesize
36B

MD5
b63f074a37e1de3c291b31d9d05e2867

SHA1
1354cdd1247f618157a3a9d39904258aea1c4f50

SHA256
daa293b441b1f00922f5e1d7e6473b7d89a55bd9e4179652befbf1a0dc787159

SHA512
ddd5dd27af316ea039bd133697c3d07365bb0d68ee624f65a1b441820d24aadd797587fe17ee857b9c5ccc7f95ddcdc19d7527cadf5c2f2600fc40acc24ace8b

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
14bfaa90e2eb6b64d5ab86228c77261e

SHA1
40a3781351150aca7b1beff364bdbb8e60e26a4c

SHA256
8c699ed350deb5be423777e454e6ba0c1468a150ac35b9342cd3fcc5cfe7b5d2

SHA512
4868ba5bb4c0d58ce35fddbc73560bce1abdc92e209d751b7f5424683cb6fe3bbf8ed25f6cb1feb11f909053f1331c7cf038d820de16af3104a9a386fccda67a

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6b2651b5a600116f42f6f2054beefb81

SHA1
0b420d8a2ed79b0861b4260c5d20ecfecd7d246a

SHA256
f00c2a08457a1d602ee81b58eb10b6a46af19ce4fd7b4e964ff810808edf910e

SHA512
96b8568623cb6fa15931e62a7351088b28e7cef874f5f0a6740201764b22c6a3a7eef5b21fba002268dc2070db5983aacd20f11c61d128b1b51eb80f12cd5461

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
56b0d4f6f6e9da534d121bada8169cd5

SHA1
29ea871c904ab36dbb05c77c160b4e2905417fde

SHA256
9b4b8169d4f3bfa37ed93e5fed9d70e700e1a43e965195732cc985c7fba9b044

SHA512
30db1e3db09424b9456892afca5248b189e0ead782cab9d29ee0c19b2f180e4681f9a0b816855272c2d8c9c5b1d931ef37702ffb10c1a708580473001821c4c6

Download Submit