17a593de3d80a66a60b6cc64fd6ce9767ced277ce88c7dddb4b0d3fec6d1d6cb

Analysis

max time kernel
98s
max time network
151s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
10/06/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a587e6da2177bd21a05640b46185de0_JaffaCakes118.apk
Size 991KB
Sample240610-dca65sbb3s
SHA256 17a593de3d80a66a60b6cc64fd6ce9767ced277ce88c7dddb4b0d3fec6d1d6cb
MD5 9a587e6da2177bd21a05640b46185de0
SHA1 8ca246e7a90c33fc3c736a3f58a21bb84de6650e
SHA512 309fa45e527648f8e34eeec0c17053cc37c3116c7eb8d64a31b5cec38688b834bef534534573bfca37836db1be44c9ce4fbc3004cb1656b102b65720b364f0e6
SSDEEP 12288:iAWwBwtQaQ6sJHBmkCQ8bcZQWWCawRo8bqRTnVKHaSmSdpth6iGdyQ+peAt2okmm:OQaQ6yCQAcrUskTVKHaSJzE9fJsN//zy
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
13	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.lukeallen.bomberml

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	org.lukeallen.bomberml

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.lukeallen.bomberml

org.lukeallen.bomberml
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4998

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mobclick_agent_sealed_org.lukeallen.bomberml

Path /data/data/org.lukeallen.bomberml/files/mobclick_agent_sealed_org.lukeallen.bomberml
Size 521B
SHA256 d1b41da58a711de5c0ad38cad6840ae4e30737aa679ab8e87bc7a4b2f5933cd2
MD5 acd0d8536c54fb7ef5809d1c7b908f27
SHA1 194198aaf194b6e01be77056d2f56901a6303223
SHA512 72279da1638357431e2d22212f74c4ff61846bd8e1fd407d8b2538cb42e10a79979779443a05e235aefd7b3967df83b1f40757eb31c21f2c38691e41e0274d92
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/org.lukeallen.bomberml/files/umeng_it.cache
Size 148B
SHA256 c5c4b968f971d4a7438a007292ff072cc414921f8d3a13315e93970d3cc8edf4
MD5 a9e8d99f6e355b2c974bc0c1a2332420
SHA1 28f73adf8d92715f0a8fa410eb071806b4ad9a1d
SHA512 47b8a97b63c217cf19c6f502376304ae8247744f63e065992e403975ad1bb4e8cc01ab2de98f487f998fd292343dac27d603e17bb5be08f189aae61d65a43bfb
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads