Analysis
-
max time kernel
139s -
max time network
145s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
25-11-2024 23:32
Behavioral task
behavioral1
Sample
9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk
-
Size
14.4MB
-
MD5
9e8aa2476bcdc551a33326f57f15b185
-
SHA1
27564a325ffe51f45928d958572bb00c20e2486b
-
SHA256
451a50c3f405e1c3f3a71c8c04f705a30c44737d22cc6fe374c9bdb8f7b4c5f7
-
SHA512
d8567465e1325af5aac56c4fa383d67ff104af16b39c089b777426571d46573442204466474b910ed9b38d1166a6d808126b6131f4250dc3890b8bf63c13953c
-
SSDEEP
393216:1UuNEt4HEep5BViqsS5vLwuUT0pvWPRtqOJePLkhIG:+uQinpjgqvvLPr1WzNJejkhT
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.dromonioc process /system/app/Superuser.apk com.dromon /system/xbin/su com.dromon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.dromondescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.dromon -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 4 IoCs
Processes:
flow ioc 4 android-monitor.ru 10 prog-money.com 12 andmon.name 13 anmon.name -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.dromondescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.dromon -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dromon -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.dromondescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dromon -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.dromon -
Tries to add a device administrator. 2 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Intent action android.app.action.ADD_DEVICE_ADMIN com.dromon -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.dromon -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.dromondescription ioc process File opened for read /proc/meminfo com.dromon
Processes
-
com.dromon1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Tries to add a device administrator.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4251
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD596ebcc837ef96c3020ecf7f3a14917ce
SHA1858a06a5b01ab1c46561613553361ee4dc99bbfd
SHA2568442d188aa164149251c743fd6f13824e1044e260aff5c8747244cdb00a492dc
SHA512a49e717f3bea56fff65242ffc6f5cfa01eda593d35772bcb646a4830a238a11827d45da83f25c91c18fb850e55912ab1c543e7e2c12e7d06de31f4a03b10973c
-
Filesize
28KB
MD5079700dd24e42c6c986319268907fad4
SHA11e11b0dc3e3c283f05aa38219a5b5417b73ec1be
SHA2568c1ce76976707828509fc7073b465ed81f6c1722cfac88504928765003f781a8
SHA512f8ee3d2d66cd620d4d1cef5e1084c0225f28fabe266a19efaf690c20cf0d4c1a362c32f3bbdc4acdb41fb189abe5b134542638cbf73d5a71a80b76c2942d1836
-
Filesize
68KB
MD511c52a543aa9244205b0f04c7aa5493f
SHA17cbff7b2c29f2ccaca9a9ccd64356c002a265cba
SHA256e32576e7888467be2837a14c125950a1d363d9da1cc284ef72e64722ad8d5100
SHA51200d22dbc560acc569cf58f27268a1a19aee031b6f8786940b954e537eafb18d15489bbaa95bead382b5c9938d826bfc754a312926833170576672e6bf35ff7e2
-
Filesize
20KB
MD5c7ffd846c29ddab36f1d08047025a8e8
SHA1646cda2068fcb644371d12d7c48c5290921794e0
SHA256eb3b679ccdfc0a27792ba5dd7b8b4db37ada6962ae5604d899d75535ce56776c
SHA51244d2165cbf111dac1f70370d069de6385109287f3feea64ce79119a651d259ad82a9cd3f7dbb7076379ba7d9db40d81be02ab529ccd31464021f064dd426b204
-
Filesize
104KB
MD54273e13ea9eb10079bffc5f3de39bfff
SHA1c1eb229c545a2083058bf9cc80364764271f527f
SHA2562d8e31b862db00adb58aa184de9373301e55fe01356d899a6493ffd3d08f9347
SHA51228dcfb2aa6852e1f14db3249ebd5789b44f7755bb7b4728a64fb65baa263d17384d4cb0bafec648f0318ca252192d5dc6a2eeee71e849eb71fd7943fae2ed0e9
-
Filesize
68KB
MD55f668471f8b0ffabfdb63263801f54bb
SHA166623c1912911289165f627f61d179378dc58771
SHA2562cfc3827c486e0445993518f5cb237728d0980cf0853f3b0c3bd060e94a4377b
SHA51201da1c2387149d2872285bee143a14b34668f40a3d7c81ceaa2f65a665a12a54d141b41e67004c129ab9df45d63c62ee408cf244bfe500f34dce5a3b89d7cb8b
-
Filesize
512B
MD593e9a844c5acc1d71a9f10548b1de068
SHA1d7511f92992c184e10378dac0aa413c9d4549e86
SHA25630f8fac48a70540892a9647a57ea494873a8f6ec682d34af1eceb02767d33a6f
SHA512366f50b894cf74954b01960e6812fe3986c6f11273ed95f96b00140890e526069465ee7c8b2703e67fd098bb474f570c1b6af8a43a34e7be731b648fda3c88c9
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
221KB
MD574e6a403fcaca277c126047b36718145
SHA19c70ed16f33e97d9c1107b2a6471e87676716d19
SHA256bcf3126247dcdb67df25a65416af91a3f3306a10a6e3fa42e32734bf3a96e375
SHA51264a41290620c304c932dfb306f0b4d3dd7bb00bd25087429ddeeaf16b60f8f1a57818fa7f6ce59fb18c1c7b03bfcbec210c02a5ab2d2acad8efd8040d62ad8d9
-
Filesize
4KB
MD5bed3c38d5af795c2fe7b57641b1dc889
SHA1a077d1e68c92c81e72d267e33ebf9ca11faa01fd
SHA2565726a0060068c654bd82226fed8b0063de8436b2cde621bc56feb655ac6f6c38
SHA512c7fece897314f7846782f4f17c3a4bf6cda9fc9628239661b5e145cd31a687fa38342107f0390ccb6f6ec86aec20586dd8c6be8a774c68667828cf1b083eea0a
-
Filesize
8KB
MD561a0f17bba78e11125ef6cb9288393ef
SHA170a5454fa030fe6143ffa6c94b14835c37e0dbb4
SHA2569237663b7c5d1a56308bf6390f53178264ca8dcdb458a25244d4380a3a998c9c
SHA51204d3aef6a5ba01fea759d7acef643320e05ce3f0d715ac400c49b53f79c466c06aa61e425e4e4665a2b1dae36a9ea45c9d680895b7a6433c20a0f94c8feb5cde
-
Filesize
8KB
MD5335b44b40ffbce9dd0be44dfc04d210e
SHA10ebba270df457ce87b1e09ecd78d4ce67be79645
SHA256bfe14ecc723b44d30906272dbbd04efe21682b22731b51da0797e5eb66cc79e8
SHA5129d425168bab53f8f3ef6c0dffab10429bfec1a2e7629373d0a6c8146e14e9a00e154b23499b7e5b7e94c4eb9569130fcc1ecd742baac10b03cd91c5f78ab231c
-
Filesize
402KB
MD55733898ec5df6cb596f71be347ee2563
SHA1981a8907c3971a87525f38cbf6619cea16409cbf
SHA2568a397e62bdbccdee7075ae1138edb6dd41f1482d0c5f13f27b72cf088a530fbc
SHA5120e066eea352719c01015d39846e2cad7cd054bfb8ed946d1a344b7385f448054f8e811fbd1945a01abc59bb840dbc5d1e4c4ab744ab8097a70d735c3af6cc98b
-
Filesize
8KB
MD59269fdbc130c046497f3461b6d747b14
SHA190b41e1555d4d9a6056a116273b2535ebdcb2e76
SHA256daf0015c22ffec558fd601df07c19338bccea0e47a1d6ec71f08baf15297b3fd
SHA5129c69199993f51127931a51d52ad8e8ecaf35abf7f3103c210bdfdf92b20a2f1d62773e94904e502169172e3e83ee10f2fac3fba61752bd76526022b824a6d33b
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6745090500A9-0001-109B-9C1F66584F52BeginSession.cls_temp
Filesize78B
MD5e144f5e075cd800e4b3beca614d8fd59
SHA1fe7ff3a498ffb037b4a94ff4502204e582564778
SHA2568a379bf52afaa611018b92c8b8f4618c4e47b6334c32a7dee6f2c1ae067a1939
SHA512cd065204261478fde24b88a7d450bee3a444a1c3d3ef0589a99a3eef66fedfdc894e0ac76ded6ef9068ba3f6f9717be585da8d22fe2b65703c3a497a791b6c9e
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6745090500A9-0001-109B-9C1F66584F52SessionApp.cls_temp
Filesize103B
MD51d5915cbcf78b07c3f224b89634adb0b
SHA157a1967aac3ddd19de795f82efbf610b599a82aa
SHA2567ae98ba3a447eca9020f9a0ff6c92d7eec3d53e353e12f33b99a0887f032bbc5
SHA51266eadbc2f24cf88249da0bca571b46400ac2474774883b8b061a60decb92a6fa6eee02059b06b3dbe8667591d5898ed5a32a88c821905d23fdc9369ed751ecad
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6745090500A9-0001-109B-9C1F66584F52SessionDevice.cls_temp
Filesize131B
MD577a89837cde766917de13cd064417fdd
SHA13d24b247f4a362b5f4cfa71eb56d19de4fb9335c
SHA256b7e7a994220f2ff3a7c0e16810c79a9c54dc7ba76943e9198d8ff4adba8af12a
SHA5122593438736f897f08b24f150562963c4818cac42eec637455d0b8be226d5cbcf237b16013e18fef9539b7b3edfd5e9b611dda71c02c74bcafb2e7284c636695a
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6745090500A9-0001-109B-9C1F66584F52SessionOS.cls_temp
Filesize14B
MD59b3d4522944ce6396563812bfdb92fa9
SHA16d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6745090500A9-0001-109B-9C1F66584F52user.meta
Filesize28B
MD52e24f7e64aa1ff176b3d0bbf66b47972
SHA1d70934a5531757da24fb6b2e4f1ec6c0e16f32cc
SHA2562eb995e182f00f6717ac27cc51e63239bb08a191569141d053d9384397488289
SHA512a2c0350774a38faa053e603c75706e37ecc3db464d1dd4bea1f9692bf663979038e358fd8f24b459198d2b9164854123d61320cd7ab2bde195ab5832f2a6c90b
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/6745090500A9-0001-109B-9C1F66584F52user.meta
Filesize46B
MD569de0fbc5ecc151462b35f5c0795f4a7
SHA1871ff44a8c5a2c682c0943c0ad522ca1dac22044
SHA2569c01223aa82dbcaeb26cc6500e86c08157e1070eaa0469f20fe2b40a0fae0df7
SHA512e1f367d078f8cb9818c3197442c4479f101f233be9a6baebb0ee20bb69bfea8bb305204e8fa896d66a47b45c860d53693ccd4c683ba73a7d3177f02b925851e4
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-6745090500A9-0001-109B-9C1F66584F52.temp
Filesize87B
MD56bc305714e3e846e3c0333a250f06585
SHA1ab38f15eb04109efcfcb2cfe4005925994509b0e
SHA256c52b21fef87d563553083b76c8866c319f7d7770478d2a9565f0c54108fcc8f4
SHA512af7c7bb2794021a5feea33115a009c012259aa3232e129c8614e62853bd8975bbd47112d2ed7eac1dce94db1281a8e2dc846af8554408013233e38fcf3f0563a
-
Filesize
464B
MD591dc7d63ff1112bacdbbe86793433ca4
SHA12e20ea4e3fa6c402e17462e2fcc56cd39bfff886
SHA2561abd53f31d9054af8b98b42af41914727fb4a9a67e13462ee4b7875d524dff92
SHA51218268c8dc6315dc8d5af4329d2b5be96251459896da906601150f2532712480bd5c93d03e555e45522552def9e9c2a3f3e071f49e19208dc9ad0433cc00d8b99
-
Filesize
1KB
MD5e9d7524222c62fcb0a0f766bee895929
SHA18b61ace9914241b5376e44f0fbb12a707c1cefa5
SHA25626f8edc10c0ac1597df76593b31231d5e33cd3baa0def329c3c8a441dc6afa12
SHA5124f4e7e5e614c1fdefb1e6e123338961fb9b428e42a943e643873ce6e1cdb081a9cb51916ef91f20b26a8d4c1ac91a6233062bb1d4da80385d1ee33f9791df045
-
Filesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_bff26e49-6032-4fc1-b320-d7c6e546e3c5_1732577553276.tap
Filesize450B
MD53718955ffe1d4c4685d52718f19af947
SHA11ad580aef0b4e5d2f5c3b02c1d21351d1a6528d5
SHA2561a1d9738947384a6af2e008a66a759565ecf40bf6fb75f90754366fc1a8ec928
SHA51262aa66ad3d8e9772e2de23805f9ad78cffdb60b1b7f4a12116b755a7a40d3603a1b8f30c8c9c69cdfa41fca49a0a7efefba9c347ba959df8d2a95cfc99a77dbe
-
/data/data/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_c81b79d8-c7fd-4b9c-be56-fdc809132b92_1732577542954.tap
Filesize369B
MD50492eedf1012f301e7b2bdbc0dbbe189
SHA14e82d92ca45af6d8a4e65aae42372b4ab4b3e4df
SHA256f4404eeb5adaf09a88e7db3252ec7e23070e2603b9ae1176fdd26f0e11c06960
SHA512540c59a0e01811eb840c6a7ed27d6ce4096b8a8bee68f64d9a283a34b3fbdb8a14eff8931dbcc27095c2ff31307bf5feb1cacb43a38513a788cea7b3fe1efe18
-
Filesize
46B
MD5ac5184902fddf9099cf65b939f89107b
SHA1309da6d599bc59e749f701ba4d0afafe47a5a042
SHA25602e182f51a08ad0491706f7acf0a0ec564ea9b055a156412cbb810049326b428
SHA51203d1b1d30acfa962b3f5883c1ce2f8e3bca777af65943a69e5fee78e1d67cbe7a180457cea0196b94df0829f64786ece394991b2c6655d1d926c0bb7d4222355
-
Filesize
59B
MD503f354e8f2101cd41082ed7e489e42d7
SHA1ac667015aa859412cd1f68e2234d683ad03bccf7
SHA2564c22b44fc8d7dd2d4aca7cb45d2ff2204afa4410cc0fd4a198b834e5d067393e
SHA512dba6bceaff63253f38d6ab9570c57be65bf1793a1cbfc95d6648aa8e31885355a7174dce1527dd7b6d4d76d97e44b8a1de90d413e17607b71178ada22ffb5099
-
Filesize
126B
MD50395590d04f1780f8428c126919f5b0b
SHA1035858d58ea2c4668ca663b80e523175f7e00132
SHA256280ddaf4053ddf02de709379729c0fa720d715fe5dcb09c0b22f1aeb5f2f3814
SHA512f36ddb362a721c59ff9746cbba624a91c8292cb58593fcbb546e3770b3f3b95411da5fce40d4dae98adefa0454da06e4bdcd86daf8a23e64b4eafdb85eadfee5
-
Filesize
74B
MD5395d320a46082c752493cee812308c31
SHA1eb6f230dea2a33cd0a1642e563cc97eec8f41a0f
SHA256390d1dbc2dcf27ed1ffd307814a27c6d5d28b3e6eb53a95d6a1f7af9e54d6d3c
SHA51219eb6ee547bf7b2e8c2e1d78aea45f4549c3d6b45087c568285787d7d78b91ebc59bf72e0f2e8f9a5e00890ab3e2103794bbb166280628fb574e7863e119493c
-
Filesize
55B
MD571743610a5d911c6bacc8dbf2767460a
SHA16b08a47df805f3eeaf22053933b07abbb0665260
SHA2561ee2c6a30866b13429bd6953ec5f8f0aaf486f270e0664ca14bacb5366ede732
SHA512927fe8ca3be6497059f19444fb5032de3d092697fe88b36e81dd3871a1382ed84dc93a214c9a4b27bf252094f8a54277f33cfae61f814b55141a702fd5627a2c
-
Filesize
48B
MD5da1ce440ea94f1aa7d50d3262057652b
SHA1f5d83015011d79676ca18fcb4bec5da7b66bccd3
SHA2565c1fa5675ae75dae6ade43d55e1be5d5351c87281aebc5fbbbcd199840cc7050
SHA512ece51b7c205f5c4cbbc4318038d08a11cc77bc310bf1fd4210ad74eb325343f4e5966646ca4492bd9a350172b3ef5b7dabcbbf41e93129c04941a98e8b2b18bc
-
Filesize
850B
MD52ae4ca49c0c94b60f561eb0712f87ec7
SHA160f99bda65e5e4176a235e6ffb26a8205224c274
SHA2566580711481d11baa730ee4b8a0ec45a059c426938f803d6651e7ee91464cac75
SHA512dcf885c90c1e2a4f3a436a9f606cc87a3ef00f1b8ebd62a09364b6734f5f38225c94786db1eb860e8325cd576c6cc683d3fcd2c858654d32fa353d1416c2db78
-
Filesize
5KB
MD5d69f7670ec2026e5a0fdefe0f4098030
SHA199449b4afdbdbc0e2c5353838c90d92b3e85e54b
SHA256825d72095c8aa220091bc4f0e3155ea808abe7a535b1027c809b4cb35e8781a5
SHA512b72b383e84af1643d1970ba8b647a7047a4be9a18a4ff7fde9fd6fd49f1a02883e4a32a836548204dd49f3009667902473216f229b4392161fea81eb00d9b5df
-
Filesize
1KB
MD5db2e9ed0e12d3d1485e3ea35c6e8e18c
SHA1abcbcca4eb28ce018378b5b7829320caf474d5c4
SHA25658269ce5abaac078a931b3f638188af865dcfb80b86189d80691ce2bbc32e5ca
SHA5125f82cf6ba4cd3db1943a8cebf104f6eba71792cd651eb14bca62ae3946764af0e275ab1ed40f05d9b68dfd7c49dbdff02b443bc38164664decc4a755e70cfc1f
-
Filesize
204B
MD50e6987d0a51ee5c4523ed23587014aee
SHA17f13fd05c4db008c1a0bcf54bb0708f810559d3d
SHA2569e90a83df6f2683b11933ca5153f954a14c020e598a6f1cd9bcc5f31d27b6abd
SHA51218ec80c397553295ffce8504d1cd2be125e1e3830184ad97bdeccc765feb74f078a5c6987767e8e0e0e70c97abaaf94a9165d58e2be7286ea622f98686462606
-
Filesize
249B
MD573b4318db514a40d8561d7430457678d
SHA116a734c183cd6df449a58cdcc0997e01ee241052
SHA2563c277292ec24b118dde2746ee7382470c4a0c6a37351757dde5076c45cd69882
SHA512d7c03c1360ea54c2d2e5478bf37b9877061a018f802c6afbdc7142f9a3f6506db7923e2a381f021608a10f580bb412634b8cfece16d2e157e231ac09c5ddcfda
-
Filesize
10B
MD5fd5b98ea58e94fffa1df623df684d3b4
SHA1eaf9952ebeeeee38df60c9648aa728f2d2f7a52a
SHA25673a03ccf7af8d3e9a1270d54680f56749588fb49511b94a424970acf69908d59
SHA5129009ead16766df475cbe0cbde7329aa905512f833b938194603242efc9f33d88ee441495066f66ed0dce55f4d5248fb3bd66233e3176c57ede357663ad705718