easylogger | 798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae

Analysis

max time kernel
47s
max time network
147s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
07-05-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae.apk
Size

5.8MB
MD5

1398c9c6999be6f56f2364ec680f8557
SHA1

396c173b4c084afc3a2c89044ffa42a3f0e4dad4
SHA256

798fafd34288fe8439dfd609d2599f234c6cf63b047f032d872d228f951c87ae
SHA512

49ae3724b60f40ac3646a44164fd6879480d895e1096825f484d63d286b5c5b8f2557bdf752f746651504bd038bf9e93dfe7400977e2bd6ba24576843b3393dc
SSDEEP

98304:BUlRb+MDHwasxU19o7SDWNYbM2Wlghs4DqHvSse0EpO9X0xUCd7Mmp3/U5uaMA:CKhdU1xWlQDuSsGA9X097MaPUo/A

Score

10^/10

easylogger banker collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

EasyLogger
EasyLogger is an Android stalkerware.
trojan infostealer spyware easylogger
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.EasyLogger

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	app.EasyLogger

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.EasyLogger

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.EasyLogger

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.EasyLogger

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

app.EasyLogger
1⤵
- Checks memory information
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4235

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/app.EasyLogger/cache/volley/-1201570017-1616341492

Filesize
1KB

MD5
a41a9af9807818421c8cdfad8a6ce71b

SHA1
0580ed9a750f563799ac3cb6411f07ad7ded1c5b

SHA256
4ebc513f14ea7156b994287e7c27454a798b373643135d12c92dc640d0d92ea8

SHA512
2341f6f0c1adbc3f15e71ab30aea722c99e38b1e10a3f9ee52368cb40e6272c36d2aaa2f593c49c1dd32683f245788a4495094b7de6623c433d460e977fdee33

Download Submit
/data/data/app.EasyLogger/cache/volley/-1201570017-1616341492

Filesize
1KB

MD5
177d683610215f629af3cb7129b4c1af

SHA1
5d0053f1d463aef8a04ca568d359aa931e3ed764

SHA256
5719ab28424fb2d1977600e55219b55686f1d70341e5b9f09f010b11b7f4173e

SHA512
7f67064f9b3c1c523cbca8c8217a618f209f9c2aeb8e00389cdab821efc07d016c7f6f37c5fa6a55da2e0c92d5cd099fc4d4f14d5205ae9be5de351e8ffbfef7

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db

Filesize
76KB

MD5
247a9a1ab8a9d50b768aea16f443ee52

SHA1
1b8ef45ad7df4db30e70051835585e526f7fe488

SHA256
6c414fa302b351eb7df14144c5c36a7ddd181615cb540f012ff67005837c9796

SHA512
6285e17579d1253b10f20e00f40aa8432e58a0e7b0b080c7ed52eafabae8f339f250897164409d1bc6512359557545998042fe41fca2e7b4ead85ab26918663f

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db-journal

Filesize
512B

MD5
92efd93a61e710edfc803b5a1eac22f5

SHA1
b46ad9ab46da85ac4eef65d00cb3785422f09704

SHA256
a4753b9644034a6c1239458b896dc44700d3af086cfd4b586765e4ba9af8e6c3

SHA512
dbe63feb1304146c142066733e62201ad3e5f82ed1eda1d073f30c7d0f6f0be86ade0fed3c48d61ced1d08bd0922604e4101e62e0e03293cf3045aa14be40600

Download Submit
/data/data/app.EasyLogger/databases/EasyLoggerLog.db-wal

Filesize
140KB

MD5
88b6c3e01710432bbe5cf2452478af1d

SHA1
2578d810240bb95e4f2d34f1efe0826f4ae9b889

SHA256
107776ec1252f043d503594e707a67608c63e996670d9a0b96192451d4dd32f4

SHA512
54c1843d4118e02c8d007552971a831856afe6a4b76c13cafbbac1d8b6f3872a5bbaf74c346f6317c86cb2cabc29cffb19ac9af810db87363140454c89427040

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
ee000faa8b6dbe6f55797ca1ec12402c

SHA1
ffb29394a28f6c825263f3f4655daef7c8cb5cfc

SHA256
24069ba119c8cd28a77d8eba45e32f50cdda7886652a72c73a262d647a8b58d4

SHA512
bcbd1f33988e0ea6b8eeb975276efbc9d3e1c4e17084e3b7f801f9f4d4646a8efb50354718a3d48b370ea7c7c729cc775ceee614eef06231801ce09488f4a84b

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/app.EasyLogger/databases/com.google.android.datatransport.events-wal

Filesize
52KB

MD5
b02939bbf6446921c3b4d6878bbb21a6

SHA1
2ba0b7e1a19a0c4e9721c9884db2edc4236d0db4

SHA256
871d02581b7566970c4db5ce91e21660a5d246a38d1cf7dcc25ef3d4c017d1d7

SHA512
850a504d96d3874ebfdb2b351edba2cca536f71aa103525aea5f6a408af7abce58502e64f97fe021942e5f42605299fd56184570b0b957d65252f32873834c04

Download Submit
/data/data/app.EasyLogger/databases/google_analytics_v4.db-journal

Filesize
512B

MD5
c676494653de48c114e1c53882b0cdbd

SHA1
5e9ca70faa7cb9a476479baa2e0aafac6a1ff617

SHA256
c8bff7bd6c32299f9471e03b86cc6753fffd9eb1af97f387a243c5f6f9b3156d

SHA512
ee144106894b0299f1c07fcb2896d7b16c71b4e585038d6432d71594a8c3be2ef1cf218bac52d8362ba3b9fb1f229f5e50c9becb1577c05055edfef9956dbc79

Download Submit
/data/data/app.EasyLogger/databases/google_analytics_v4.db-wal

Filesize
68KB

MD5
4cd1488d1bee0356565aefa0b66e30d5

SHA1
a6b58a1b8c4fdded58fccebb6490769c5271c8d3

SHA256
6171e9147a456c41b89ba22a6cb66664b8a4303d5588f90f740bac4949ab1f81

SHA512
fb4754fd87a90270504c305ca858e55e8cf2d103fdd116ccbecd2df81e73cb658604106c6c2b0be4423ce55f1042c15dd8930c998238ec2d7001140072d367db

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
1a78ff67cd0d9440c4ef9fc94150efab

SHA1
c5158075eca7aa2fd20afcc7d6dae1ce1a9f4ae4

SHA256
d54253946ca079abf8548a2a4f657a35ed921568d3264cdd1a7ec9a6bba0a8d5

SHA512
727642eb151b6098d2a3931292013bbb1619ff33bc4b8e40e7b22a23b80d70bf6d859e58de70c82e6a7eaf9d0a8bb5c4a54417c33c0c8ed95a7380d7d67b7b52

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
49ef8326d56e4887c96d4f45e9103116

SHA1
e009db3dee8a721dfb0e97134117392d65272c54

SHA256
6966ee5ae500ce14c47091eb5faa41821570388ad365a83e93bfd52b3cc63b0f

SHA512
f6eb7c362735f0e59bf959c11d6776594954e24504d86fec8171f1eb486562da8bee5c2a4f08a319cacab8a8152f2e4fff94f5cc211ea2f945aa3929638c81d9

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
bf3ff3c5cde9182fe70ceb70a687aad2

SHA1
8f870163be6292775c00e27cd754c31ce091f342

SHA256
5a55f4672d40860767a6aaf3ef958bafbe1a92236ea6d9b3d99e3f6c8f814153

SHA512
d5e3267600240d2a094f2181190d5047f0ec18884d09794366a7c0fc7091752d8f642929c26c0fb0c0fa55b7808aa0091560897a8e03e49a9406b2302d34a066

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
0c2bed581a0a86f0f97602d6491923bd

SHA1
ab58b769186dc014c71265d342a1f92ecc42e66e

SHA256
6991233daf9242fbd656275ce02af09dcc0e06244bec934e545439066f231756

SHA512
c98a21cf2722743c34b3e8a44128f2843626e4a906b9a67b975f1a0178a0c4337f8d7be0aefde4f32e41f48fe8b78b4c06936c16e0a30994d2644ec9cbbe188f

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db

Filesize
16KB

MD5
ade57a9892c105eb146676b760e41e1a

SHA1
4ae761adbe22de8b6979c1e3b6f9129ab8ff2c11

SHA256
273783621ede4e3a64953b0f7bf0d9fc8ea1d76a0d3d822f94f568a1d9a36eb6

SHA512
aeaf10d02cc568f8f5a09a713bbfd0ebe83d7fd2f66903bc8a64e75ff83d9e438fb937c2f76b5424e540b10f6260ca29477d8eb7370f35cb3ba74ddf7892d8fc

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
a06b59cae91e8a998d1168e83a27abef

SHA1
e09e03779df5d5da3fd4a1f0e6557a5a0604b001

SHA256
905a4cc3841a55cc65cced0683c749bbadbb5af95eac163f0a95ea7dfa2e2c15

SHA512
c65c0f5ed1deb604b1d199573fcfbf520ac8eb9f9fa384b0dacf1350c4f2c6b09a229ad781d48b6d7f6b399e31866d34268f6fc4f036f4713a12efaa36fbd66d

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
7effe5b2e80a3b6807c77cc6ba7beabc

SHA1
709f03116d5bdf70c4b08a31ea84a5c404b8863c

SHA256
78e4f3341557393f4560618d598f5d52cdec019677fb829a364d1fb58c25749d

SHA512
afbccbd0ed292645494602275931fe95d47a3c4d9a4fa4fb6f71a2d72d6ae045f7b7271a58c0614ce222a0dd796a09d9634a0c0f335a82bc649576885825ca1c

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
222bd81381aafd7d1c88ee6368aae9b3

SHA1
9966f482f8c34fbe47a84483bf6df32662adac69

SHA256
e0cc4ccb903180d5cd1cf31c7b02c51409196ccd723eeac3bc235ae11fc549ef

SHA512
a8e8b6fb8ab931c58d8a0f49034bfb906eb2287be74d203f430dd6fb434ab7b9b29caead9a88b682c7aa90dc1fd6e4edd2631275519708cd2b2cdf532856ebd1

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
2364e0b568830dbd8db074e6dfa7f5ea

SHA1
8849bdcac83f72b9da0eb295654c35face687414

SHA256
fb1e8825403570a775ee77a60f35894ffd75af2ffe642aca14e6530d25b5737d

SHA512
d2c7d71c82375daafca65312f9e76a9569718a3809df2a22a0d468f3492264909fcd2bbd878a7ce29632b1bc137997567f4865bba0d2c3ad76f85be32e57aa17

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
6f8b8dd7d90dcb759373434aa72b8a30

SHA1
85518776c7edf4b4d4d42ea712887b2922e20cf7

SHA256
4a3339783e6755f5c2762550d2a7d0c463aff4e095d3d51e78d233151f317566

SHA512
42df8043dd083e38f3c4871bdcf9eff19386ba7e0459f03c370bb897bb1fc9314eb0ea0acdafaf7e1a506a3369447e76b9aac8e1601e6a4b5915e42c35b9d47c

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
3bb4e320c7c1e45f96afa6e6c9ff412d

SHA1
bb565c8551c04b78f83c43e78a2a6e94c157a303

SHA256
3772b951c10feb8d6405cdd6e71a6839453bbc83fecd3e650b56447d36b741c3

SHA512
b9201bcfb661769dd53105b523d2ff33cce03f6ca5a20c01246c56a62226bce57bebd165be7b7cc252e7b1c09471f10d598b1475ce7744ebd4a0816be740e499

Download Submit
/data/data/app.EasyLogger/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
a3dbb588d99a01e1f895c3b97e213741

SHA1
5852fb3782c1ea34795a3bab255df77f281ea39b

SHA256
46c74bb1015d7502e8f6087326b170f77433a3c0afde8303af7512dedeea4222

SHA512
f4e204f2b511b96693c76dd4ecf8defea880cc9659c796fde9eddb8959e18283ed365ea7744b0197cd03c37edff4ac3697a0c25f3d3f5697b7b348b22c593aed

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json

Filesize
710B

MD5
69e8b0af792760efb51d53190ae923b0

SHA1
27b4139cc598c507be7cc609d655a9660fe66b7a

SHA256
db3352e00184c5ac992c20ec0249bb64981ef18bf9678326ddd876fc880d56c9

SHA512
0996b32155c16f218333b6457d7b9f05d49f91d135d6d98f40b793f2dd17a2ea41484f507c6e28f0d975b04045fdeba47cd4fdec57053a6ea535b75c0eebdc2c

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-66398E8700B70001108B0EED951177D6.temp

Filesize
438B

MD5
a7f153aa2f3f0e288bb4c34663132d1e

SHA1
0d5e51a5f7654e037890327fc2b4ba320680d115

SHA256
4fed531bfc4e45896fd6f5b6e647e6d9af969d76800b5925ec1511b04abe8883

SHA512
148aa9655c6037a1083ae29d4e3629c0e0822677a6526e35fa12830655fe1ed58510aafc694d3feb6c2eed20dacf4a1a318843a37c3e661592975735f66115e1

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-66398E8700B70001108B0EED951177D6.temp.tmp

Filesize
16B

MD5
c33583fae4e0b61cde1c5b9227963237

SHA1
fe2ebe4d27469af1460f7e852031a04208ef629b

SHA256
35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

SHA512
fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

Download Submit
/data/data/app.EasyLogger/files/.com.google.firebase.crashlytics/report-persistence/sessions/66398E8700B70001108B0EED951177D6/report

Filesize
732B

MD5
f6943b4ce16c3f256f3d447387fdf138

SHA1
541368f530cfac3b47a48c4eb6dac09aa3f1c59d

SHA256
e5409292108814f9770180c7df5e18866f83d39b90dcf8ee777daee6c08a9385

SHA512
ef57fbad2d2a42096e98bb5e6b1abb3a273c774afe0b585ec729b7f402f226643334f0e7af157fb4e1e9e0a8fd4b5002b4b273c481f366df8d9fde7b0f178fd1

Download Submit
/data/data/app.EasyLogger/files/PersistedInstallation1103155642508191316tmp

Filesize
90B

MD5
47f209f9336c770008ba71f86f88316c

SHA1
d3609b1ff9e5a1f5a44f49c672ddf3fe6e706ee3

SHA256
0ac5643e63c51b755724613210ef4d6f55efe081c0545d2ac41438932b6b5a8c

SHA512
39cee2f87ca5f205d7880b906f94ba920ad3af817510ec978ae0ade5311ce491e301ddd4ebae2b17131c5f53b642b1b6e74b11a3bdf332d02dcb0fa0905ce9f5

Download Submit
/data/data/app.EasyLogger/files/PersistedInstallation5802742878056360750tmp

Filesize
561B

MD5
25cd5583e836c5c2d13473b52bad22dd

SHA1
a23a5f976bb5b1bd6b4ae4ad9b9059c460c1400f

SHA256
ea483ed378d084b8dd3df53f50d83da4f96c589a23400c273299cd8d3dcab0cb

SHA512
1a99424a1190cd30e2d47e60e56d1844a9e1dcfcd7c45a8d942c838d9c614e9cf2d84988be8fb40ab92a43395aaac2639136efb2edc9e487845616ae85032acd

Download Submit
/data/data/app.EasyLogger/files/gaClientId

Filesize
36B

MD5
68ea19a24b139da0023dbc201b99ade9

SHA1
80ff462f00776a7bd5dee55d72a944e159f8e5d8

SHA256
443d4167206a5a98565f0a3242d63726c7d9e9e4767728e4e7cc8d0706861cc6

SHA512
db05da1349ea6fe54e043eec248dc06171f76a891939018e626311b69eca6d785b296cd02079f9358bcec92969979c9a842f264fb00554a642d57adc9c050f8a

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
8b781f7add2fb953b9d66dad9a98c15b

SHA1
3ec16514c3889a8c111d2069e45e33a379de7479

SHA256
a0605b9b3d6f1e1a6ca832f1e5dd99f985ea45b99f16564bede8b42b03986fc4

SHA512
23014a2d01af5d70e4c0328c85075096063876f281bfc95f788c49adf0fa1b7718f694ceb0ae3e956f3645827b13b1c46ebece36da99d841c0222da1948ecc78

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2795c0fb9634499c3ab0c11c43ab9071

SHA1
024f4736826c3abf2c056005da1f6370a85de86a

SHA256
20ce830482f7930742a9300375e77b08f2845c7a4e28492fe94e8f36ae7982ea

SHA512
555d230461e3493cc0bac729c524863ec68161335631b37cef66d9c76957e027fbbefdf2618f6df093c8aecf94b15276d14cb9cd9c0fd53c9a979330b631d08d

Download Submit
/data/data/app.EasyLogger/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
35c9a0410eaf1c6e62d4d112110b8966

SHA1
77de3ffcd4ead6adc1f6f1962f489ea43c7f04d4

SHA256
f09b04dbdeac34acda6d7b7f697dc2f6d6f459e42d9ad035357734e8134429ff

SHA512
1cf17d81aea4660d3b0f9b282ae5e7dd0ee9414fecedba7c638f75729d207bd6eff544b9b28f891f8b53ffa51b0fcb79ab4cd24aed813c5af9c340ef251aac32

Download Submit