17a593de3d80a66a60b6cc64fd6ce9767ced277ce88c7dddb4b0d3fec6d1d6cb

Analysis

max time kernel
171s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
10/06/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a587e6da2177bd21a05640b46185de0_JaffaCakes118.apk
Size 991KB
Sample240610-dca65sbb3s
SHA256 17a593de3d80a66a60b6cc64fd6ce9767ced277ce88c7dddb4b0d3fec6d1d6cb
MD5 9a587e6da2177bd21a05640b46185de0
SHA1 8ca246e7a90c33fc3c736a3f58a21bb84de6650e
SHA512 309fa45e527648f8e34eeec0c17053cc37c3116c7eb8d64a31b5cec38688b834bef534534573bfca37836db1be44c9ce4fbc3004cb1656b102b65720b364f0e6
SSDEEP 12288:iAWwBwtQaQ6sJHBmkCQ8bcZQWWCawRo8bqRTnVKHaSmSdpth6iGdyQ+peAt2okmm:OQaQ6yCQAcrUskTVKHaSJzE9fJsN//zy
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
9	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.lukeallen.bomberml

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	org.lukeallen.bomberml

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.lukeallen.bomberml

org.lukeallen.bomberml
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4187

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mobclick_agent_sealed_org.lukeallen.bomberml

Path /data/data/org.lukeallen.bomberml/files/mobclick_agent_sealed_org.lukeallen.bomberml
Size 548B
SHA256 68c63f61304ced7bcd8a13e1839305c4d0fd594a392686617052d9ed1671fba7
MD5 7fb03f1bf4e9078c69b981eb5458c12c
SHA1 519f11d163b16c73f89cf9d15fe90e821636d31a
SHA512 f6c2c931aa1eff72572aa473e37bc314e6ceaa3e149be1fbbda7dc25736a73b8241121e16640ecf7acd756d0a29ed5b14cffa2f45766c8e0b19a5450b11ecd46
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/org.lukeallen.bomberml/files/umeng_it.cache
Size 211B
SHA256 076afe0dee9a70cefc4d73a2b8d4eccd3ec6ae1ea73a99584cd6d67999e558e2
MD5 97acf41581df8f77990154fa348ce43a
SHA1 6451395a2e0622927758bdbf4e20cf98de292c24
SHA512 914876539e6f6db42ae958855468672bec28a7fd9e4ac6daddfa104b273413e829779cb4fec1daaea76be6fe7d1adc2f19f902c60066b8b888ad528f952948a5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads