17a593de3d80a66a60b6cc64fd6ce9767ced277ce88c7dddb4b0d3fec6d1d6cb

Analysis

max time kernel
46s
max time network
148s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
10/06/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a587e6da2177bd21a05640b46185de0_JaffaCakes118.apk
Size 991KB
Sample240610-dca65sbb3s
SHA256 17a593de3d80a66a60b6cc64fd6ce9767ced277ce88c7dddb4b0d3fec6d1d6cb
MD5 9a587e6da2177bd21a05640b46185de0
SHA1 8ca246e7a90c33fc3c736a3f58a21bb84de6650e
SHA512 309fa45e527648f8e34eeec0c17053cc37c3116c7eb8d64a31b5cec38688b834bef534534573bfca37836db1be44c9ce4fbc3004cb1656b102b65720b364f0e6
SSDEEP 12288:iAWwBwtQaQ6sJHBmkCQ8bcZQWWCawRo8bqRTnVKHaSmSdpth6iGdyQ+peAt2okmm:OQaQ6yCQAcrUskTVKHaSJzE9fJsN//zy
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
17	alog.umeng.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.lukeallen.bomberml

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	org.lukeallen.bomberml

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	org.lukeallen.bomberml

org.lukeallen.bomberml
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4528

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.imprint

Path /data/user/0/org.lukeallen.bomberml/files/.imprint
Size 765B
SHA256 3137ae2385b81e7997489f966a0a737e6b293ff43adf3484a68b49f2ee698184
MD5 732d494ef192744d8a35fc13cdacd008
SHA1 708dcf47baad8f5b14db68401ab28f60903d329e
SHA512 8c8833fe82a37230527c4e1b77b6a9b023729834bbf97a7426c6d2966398dd8c9f579dd7a0b1c6f9b26401f04030c826bcebbccf302b9a23a1d2a7da8f4c0e63
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/org.lukeallen.bomberml/files/umeng_it.cache
Size 148B
SHA256 fefd7615ab36a36f0b8d655fc26aa2aa0c7da30764b51076ea8740327f45fd42
MD5 aa5c8a710ad5fac8c0d86d39bf125961
SHA1 8b16618cb5c31209d4ae751e9855a400388df6b1
SHA512 c80e5435ed38326ec2e897173ee0e81cfae30da8e0cb1631a4d354fe76263f1168f9aed2fcb006721ab8df0a8ec3872d3e430298dd229e35ff44761d63c57450
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/org.lukeallen.bomberml/files/umeng_it.cache
Size 76B
SHA256 cc35b3da45a6cba5a75f0c040150fd1fa600d18b713c99ff77729716a8708663
MD5 540d798ac2db21f78659da39ee182604
SHA1 3342a10f507f8969e581abd0777b28d85d62102c
SHA512 9bfeae261052679066a12fe6839ef4f30e9cb23d9ac331aae344c72b2e2759cc4024918e0e29a044fe72a46ae5044e85415a1d10d68b881a941a45909afdb911
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads