Analysis

  • max time kernel
    129s
  • max time network
    138s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    25-11-2024 23:32

General

  • Target

    9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk

  • Size

    14.4MB

  • MD5

    9e8aa2476bcdc551a33326f57f15b185

  • SHA1

    27564a325ffe51f45928d958572bb00c20e2486b

  • SHA256

    451a50c3f405e1c3f3a71c8c04f705a30c44737d22cc6fe374c9bdb8f7b4c5f7

  • SHA512

    d8567465e1325af5aac56c4fa383d67ff104af16b39c089b777426571d46573442204466474b910ed9b38d1166a6d808126b6131f4250dc3890b8bf63c13953c

  • SSDEEP

    393216:1UuNEt4HEep5BViqsS5vLwuUT0pvWPRtqOJePLkhIG:+uQinpjgqvvLPr1WzNJejkhT

Malware Config

Signatures

Processes

  • com.dromon
    1⤵
    • Checks if the Android device is rooted.
    • Removes its main activity from the application launcher
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Tries to add a device administrator.
    • Checks memory information
    PID:4643

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dromon/databases/SettingsDB

    Filesize

    68KB

    MD5

    fc95dae313ac0760c1e54534d676e5c4

    SHA1

    6908651ddb656a8017a52f56deba98de4e851db8

    SHA256

    fea008a23939ee1dc3a461a9a4aa13d6b71df11d1129389c21c36931b86b5852

    SHA512

    041b165af3cb3a9e54a05b93f9c9a7b6a551873d43187ab51b746b030863bfaa5985acdfa26764f115855334753b9bc4d3867f5da640db0c1f2d2303343e8b5e

  • /data/user/0/com.dromon/databases/SettingsDB

    Filesize

    20KB

    MD5

    35779096718e5332358f4c6559241932

    SHA1

    47e21005e8c38b464053292c794e1074acb9f54c

    SHA256

    9265bfd181291801656acb313c57c6677d07b809ed04d12612da43516c502dc7

    SHA512

    d967067bbcdcfcd3c2eb273191b68429fdcd37ca47174bf550df3176d309298202fdfae80a366d3a2fd82f8b42c68075e3317bd5ce2044cc1bdc21d0c4d38588

  • /data/user/0/com.dromon/databases/SettingsDB

    Filesize

    132KB

    MD5

    3ecf91128cfcf0f9caba8db88fdab7bc

    SHA1

    5b33d574297551c0c5305f6a344166a7cf07ae06

    SHA256

    71236d94f3f1aadb23e652d05cfe9d0c656e78765515502cea3753b4d7c5a483

    SHA512

    4a7e4df0dfc9ad8d0c1ad5abfac125131526acd86532acd7961fa306e59d35b02e2c2bd48ac4fe9a14c0b8f409331bd8ec132d1e78e3bf19464fdaec56cfb2dc

  • /data/user/0/com.dromon/databases/SettingsDB

    Filesize

    68KB

    MD5

    002d37a9545f742d4d69ca1ab25c59e5

    SHA1

    b4433e52c2be1fbe45c4ef0d94c333c991bcab50

    SHA256

    2e6aa55e0b0a42c347395dd86befab11b32a324f66127ea0080a94581dd18a7d

    SHA512

    eeafc24c9f921405638ab35ab9508e1476f199eeb10dd5fe0a9426cea1317d9aebb29f605af2eaed79ea3f5440909487999b1aa0a67808574dd94530ca18dcd1

  • /data/user/0/com.dromon/databases/SettingsDB

    Filesize

    68KB

    MD5

    4f89bee8311851d72f8a3e0fcc501693

    SHA1

    43a874890620ff9a6ba2de76b2e9cae8f2dafa46

    SHA256

    a260d12347a9d506fd74ba4b42a74e08e8edbc18eb83c440b58367f29cc6da17

    SHA512

    e5e4c41215d818c51f651a93404a63b5b48ea6c51bd1ae08c158c0caac117ec53508c2a426979310d4106d5e948b082b90374e46a00cc83abd665ab0d255363a

  • /data/user/0/com.dromon/databases/SettingsDB

    Filesize

    84KB

    MD5

    453abd62cd582a3c172404955989aad2

    SHA1

    b00e88f8e4e579d2b34e46456ea6868dfe05d885

    SHA256

    c83729d3898620c31cc0bc5b9b57d7ceb23d4311e39bca6efb6b9492107bf9ca

    SHA512

    11a0a4335c9fd5615f7ddf1c1373745f696e01458019665260a7fccf51014454cc9691f0a289ec16ba0b7e47f36e1d0d8bc396419457ea0b6945b0887c4851c6

  • /data/user/0/com.dromon/databases/SettingsDB-journal

    Filesize

    512B

    MD5

    43a9f277d906b64e7c0298f1c61fd98d

    SHA1

    fc2ca1faecf1595a7714e3502f2adaa0417592d6

    SHA256

    c892b8b81e681effce5b4fa9b2ce17a017328c1aea94048e6aa18379aa91ed36

    SHA512

    cbf8ac60ab98878d4695a6b288bc7c3cb92b556f2eb392f37e060aacc507623b1a91424b3401f6e8c6d1c05b43aea551ed5f65a69b4b8f15287e13162bcf9768

  • /data/user/0/com.dromon/databases/SettingsDB-journal

    Filesize

    8KB

    MD5

    8be3b7d0da513d34cc3e3b3d570127bb

    SHA1

    a01cb1cf93bb4718105afc9cde2602043d6307be

    SHA256

    607605c4db6bb65916ee8fd41b09e5dc43a5d1808f7bd4c608959c6174b3aa44

    SHA512

    63d20d7612c4d7bebf7b6c12d7fae85371d6195be5908dab58685b1eec50e2b9407aad5085738e2be11e82a02f001d8d913e5fdc803b286d62f445baf4de91f5

  • /data/user/0/com.dromon/databases/SettingsDB-journal

    Filesize

    4KB

    MD5

    c434a8cb818b7baced3adde3fc193300

    SHA1

    6b5f631e6b1d38f4a4229694426aaddfc8d8f0a1

    SHA256

    cc45bacdb7393affc3a3ae361820d102f60b40dc3cc8cdb464439bb768f93a57

    SHA512

    352213fcf92d882696ed7b4f1dc59be68c9600e7d12aecfa04a6f44715e0c1b5410e65e7b57e57094b4dcd4d36cf57626761cd3c5bf36640ccde51ce729fd614

  • /data/user/0/com.dromon/databases/SettingsDB-journal

    Filesize

    8KB

    MD5

    b4b964ebe25e4ec0243bfe08ff8779f2

    SHA1

    e01ef4fe05cff374bcc3ccef39803b85e403ccb3

    SHA256

    f10d8cba42604537de4e1a73bb198f5bcdb6b4bf3aabd56ff6c15a6844d0d71f

    SHA512

    3845565ae1904605f2210cad0c008ac0ead19b1caa64582d27d6ae8d968aeb7b2df45fdfd190918af7e4ec903b4b861a1ad56147778cc9470c7ba2d27d696d6f

  • /data/user/0/com.dromon/databases/SettingsDB-journal

    Filesize

    8KB

    MD5

    d871506d70d2a88359d2c301133def0d

    SHA1

    dac6223fde5546d1ffbce2fda52768d25baffcdc

    SHA256

    b9a60131d30dade99f7cef2f0d63d8122c0d4b1ee0ec22914ce5f041861fec36

    SHA512

    2a1fab3b3149e2f757b498115c19c911ae94a0b6b1fb43be6e3d8fefdf22c77e9eb37b1d1238f25f8e04dc9ecf9c9bd99f752cb7b5ec9ccf236c2287b9f9575c

  • /data/user/0/com.dromon/databases/SettingsDB-journal

    Filesize

    24KB

    MD5

    659c32d889775e89d5ed5d429c8cac45

    SHA1

    c55d87f3b8acbb2cf237ea9ecce5e164206cf8c8

    SHA256

    2329e15ca7b2c6a88650054067676cc3e0ecfaf62de2c66ea92a4d843602a43a

    SHA512

    c22893c3cbf46d57c3679b890f4370887b706b595c39739b02ab4599eadd83de57b974492a12abf4929ec50e94b00120dc69bf01af1cc410be7435b5850a9d04

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CBeginSession.cls_temp

    Filesize

    78B

    MD5

    67b579e9bcf7e2ebc051c2cabb8d0df3

    SHA1

    39570d4b9705cc7015c4ee8817291b72fe5467da

    SHA256

    2169a41caa095501978b87319518ff4dc131548136658a0a8705c12a61150963

    SHA512

    f0eb5d604870d1b58d3cae8c21550970d8125431494b6fd7cc2e1d5c017e44578ce369126cea7b4c645739eac25757fedca329335fa13ebf242dfd7843490367

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CSessionApp.cls_temp

    Filesize

    103B

    MD5

    9b74cda06743fea3d75b6cd404557b6f

    SHA1

    279c0836908920509daceddc299458b81d832a83

    SHA256

    884fce23635df88e4dce0d36dcb2798755ed1aff83af72dc6a7b1d1ff66e68eb

    SHA512

    b7281e5020d598a2f42113b9014aed6653da4edb879ac965adbdc90b3acd316e3b7f167741ec500917f2fc439782cd924deb211d9558d4cbc9794c9f3e126f1e

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CSessionDevice.cls_temp

    Filesize

    131B

    MD5

    e7b401ef2d5fb18e1dec8a64a9f096b1

    SHA1

    dedee24edfab2677d62e8f468edfd5f63565b4e5

    SHA256

    00c99d56ba55451e69e673a5cc68bf656164b17e42e500897231358e3f9bfc30

    SHA512

    eeee378f55407e3961ae9abccc917f0fcac3b8fbdef083273d98b089738efd957d2aada2f39f0180f3cb08846fff8d0391e52e498c78ca9b3ac063b0d1813bf9

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CSessionOS.cls_temp

    Filesize

    15B

    MD5

    b3d9541cc92a9153d14e5160f8d8c008

    SHA1

    2e1ac80eb381dd82a03795b682f92020348c0113

    SHA256

    1ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d

    SHA512

    78074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3Cuser.meta

    Filesize

    29B

    MD5

    6f3bf9dd98b2e511bff7eb204ec6d254

    SHA1

    b1eaafe8cddf7b98783a095a725d6fc768133d00

    SHA256

    b2eb715b3b4b639f36fedce1ae2d09233544a0c234821be07f96f16adc0659d6

    SHA512

    0bb7d5e43f6441afd011935a0edb8a8482e169f10e3860ca4b70418aebb7866138fb2f257c72bbe66b9f736a9898fe226b1673c8e11bc6c9845b4821877ea372

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3Cuser.meta

    Filesize

    47B

    MD5

    fc144e611da462ed2c0aa3aa355698f6

    SHA1

    ab574d0a0c2a2d2facdd725509f0df60fda6e011

    SHA256

    32482b6a4b7a6f806e6ef7e4b407e910fcb188507fb0c3d3dd1af5e95c75d86e

    SHA512

    fb6e0cb39e8a3e0b847796ef8e1da209e9c33dbed5dd1b193cf1a14c24be364548358341e583bda6e27612a56c4865f15d91897a0a7591ecac243e6cc3a895e5

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-67450907010A-0001-1223-3634128E0C3C.temp

    Filesize

    88B

    MD5

    4f17a6f173cf19db5168267bff8f89c4

    SHA1

    0353e336960b84a7d7242cc13e57838ac95bdea9

    SHA256

    e6bc7ecc05935d258fa072c44d63f6faa558038fc2a82042b94eca76a0e3355e

    SHA512

    40a4e95d4d95ec6e541c5f81b1b2696d62d8a064b384c3321bb455516400bcb0011b4160d72eb95544126c47f3b386936f986a193851289457a5ac230b4408e6

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

    Filesize

    465B

    MD5

    1f5cf48a84db522deca645aff93361f2

    SHA1

    3c87dad115bc94f72cabafee27dc5432b115a787

    SHA256

    1b952be9e89bed02c6ebc66d803c66f0b2127e6a97a4d574452329ad2a1a1896

    SHA512

    6fe239fcb150408a2dc82e15df73c5a53358a65c2048fae7e53b5dc78db32ed609f0800f65f2c03b350f19568a5ed410de8bdb63ffb529bec892074a84c1a511

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

    Filesize

    1KB

    MD5

    afde4d99c1acf5199a251d162b97271f

    SHA1

    3330f170eee45740479b057d553d004ca24fc16f

    SHA256

    997ff399e420a58bdfd62f0f8a25133bb2816664e2d5ff1b5b0b5f122cf0ec47

    SHA512

    338f59f34c1e1715f3039d5982fdf59d6d82d812535432daa839254e364edf084a2d735f77eaf93ecac4a9032d38be01484f983db62716e1458932859538acf9

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_3ece8049-c459-4a37-8d75-94cf18b156aa_1732577544919.tap

    Filesize

    364B

    MD5

    7460cf904d6ff695263f23124086ce30

    SHA1

    59bd5a637593344a28dbb442c6ac4c056e31b4f8

    SHA256

    1d1796b9bdcd4e031cc8593718188d34255d9264436e5523dd2b9d94e499a4e8

    SHA512

    56269317efb207de3d7354d1d211d56679ab926797886980153afe94d6400d5f0b3e630a39df3a59a346bd9d8dad94c1188a43b16f37678efabf500f0d6c2831

  • /data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_9a259351-ad9b-4f9f-b452-18d7fab89a52_1732577555162.tap

    Filesize

    449B

    MD5

    d86308c2620ea3ddbb4311f0c9127c25

    SHA1

    e3de71cbcbc52c0b8b052c7e4375a3d2a86970a6

    SHA256

    fdac031d0f9f449eb148406147831c0eebc00b276dbb9772132f0edc5d4a6e71

    SHA512

    0add77888e75cc6d88fb347d5289c8ef2af7ca163d9910912266d67f4ba80bda86d5a6de2e7f2fe62e1b0b2ad188d1228009ad07b9a91d2044fc5d41bca924ef

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    46B

    MD5

    e9d79fb4c4cad632e05874765011366a

    SHA1

    a07cd59d609615dabb85a0075bfe51255e48c897

    SHA256

    fee63a4a71adb94f469f203b506e16787cef72e8e6c6b878b73f3ff449dca67a

    SHA512

    70cb50621c98d9ea79122d8ca6401cb53418c8df1162f5812f9b2666b8a4545ea11a6546f76a56795eeda10c4f766eef479051268758467766b2728a767d4ee2

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    59B

    MD5

    a092942a80894646abd2acfd93671e4d

    SHA1

    d98a21b09d9aadb12a9491226836b28b57780af4

    SHA256

    5e955a4d65c79d2db45ade0b18a8ebc5184e2e128badba1e6175384bdd30332a

    SHA512

    5b4e57dda174a533f0859dfec48a043563961aeeb7df55d53c0e7d3c95bf00dfa54078594eb8aeffc8defb48b0c1e10ac768bfa4c3ad17f2bf2c6086aa4e39b5

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    126B

    MD5

    db79d858b8d594a3ab0b38657f0ce846

    SHA1

    b74f1dc0ff766729cf9e7238acd2731d873119c3

    SHA256

    5c3129c15542481d9fe8137ebd6cbcbefe52133eb4447797a31f383c05710a00

    SHA512

    402df37d37f1ff1d7952f6f43c7a387f2aeb6069c234e6a11aad6dda0ade686a0782fbcf0d2b542bafe2913afea604b7dc86b01c9997288a9c102cca7803e62c

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    74B

    MD5

    4f0a1ce0e05471530444e8a73dc554cb

    SHA1

    38407ad8ca28978599b5d0731c0e49b22e48f7fd

    SHA256

    cfcdbe6c0b1c516fba53142aa01815868ff8ba3c3e4042beae61c267453524e1

    SHA512

    e062e9e3470ef5dbfe988ff0ab62be2036c51ea43a41769a80bd60143488588ec3093f08a45ef024708b2388a771911547a9f8351d260b466b3632d47d5d7f0e

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    55B

    MD5

    52d21b7daf4a192561bdd7792bb0d852

    SHA1

    8d903e8f699d8b83b0c180770ccd9f792eb652f8

    SHA256

    97532829b88a7d57235db74896b2d9a90d579b1f7a9698965a1f12f71c143040

    SHA512

    5118c90ecf1cc21caa693d80a50e75b1e89f8ec45f650f23975872a5b19da294be41fe2dfe6198089130aae5c36dec9477395987365218617ecdc67ea8fbcb9f

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    48B

    MD5

    098bf7a610a7400835401c8fc0f24f41

    SHA1

    774a60e4057b7352d48a6ca1dc07bfb886dd3496

    SHA256

    a3934466cab6aabee703c53379b91f7aaa10e1ced17bfa018781d9a53c961def

    SHA512

    4715f4a758e7d3d8f331fc84a0aacc23c75b4cd186dc44ea69b87ab7b8ca7b080ddf1ebb6e70fb3fcb4c6d2f06ec44026439203fca0061bbaffec7fdd8a9a12f

  • /storage/emulated/0/.androidmonitor/log.txt

    Filesize

    850B

    MD5

    b7d38ba2726d5ad28a849bce96048805

    SHA1

    26bcc08a56e77ee993451744a1cae1b83d16b94a

    SHA256

    905c422b326e7c5910e9e7449233daec1c85e2a51f9a0761d91044fd88c34538

    SHA512

    16dd1ab47c38ba3163db97ef58bccacfdccb3ab1a6096e01d7f3cfdf5cd9d340f0a9009930b59c91e835db79b0058675fde6d1a140223be50407e1e4529ade6f

  • /storage/emulated/0/.androidmonitor/log_.txt

    Filesize

    5KB

    MD5

    7fc9433a62f79e67839ccf8c07c211ba

    SHA1

    ee6801d6674cb1fae2365cb6cee3df9067c658cc

    SHA256

    a49e07edc884523128cbf3c24a8b9769cb396c0da0c5c9ce862d33d7ac904349

    SHA512

    e5297860d7ad594e35b1732732c8d310b933d9b0bbb44c07c15fc6bd99c5ba8ce7be5703048b4152ee4054823e415552e77f5ab84c764e72ab0b1ef340a3be25

  • /storage/emulated/0/.androidmonitor/log_.txt.zip

    Filesize

    1KB

    MD5

    1fa5b36ebb6a3add4e151b4ef027de7d

    SHA1

    1fc63029ee6f91b04a88633ffe6e398f5ef364d4

    SHA256

    3aa9ca365928bd3ae6a4204c2269a641360fcf68c3ea1651722c3d3a2d878d12

    SHA512

    886f65a94f485135be4368d49131973a686cfae113482c32a559b5c6e126ef0d5180f1d86bffcca6c50fdd92812b60d552a86de5b9d6e9fcf20d45c4a4a90291

  • /storage/emulated/0/.androidmonitor/log_1732577543078.txt.zip

    Filesize

    204B

    MD5

    5a1682b8311b05888e39217e4b5f6b13

    SHA1

    6dd95639cb5c67077fc82b6f918202eec05cc849

    SHA256

    5dc229db97ff83df40cfcc97b677b84b6f9a5e35dc54ca92e426417fd5b2bd99

    SHA512

    9319dce1de6eadb6800e4c61503e41c88f1d6a1f1761cdabdfd9d1781f342e7d26faf5542fa3921ada17395998f8e302dd26285fe6405fa70a32fcb3b5193fbb

  • /storage/emulated/0/.androidmonitor/monitorchecker.apk

    Filesize

    249B

    MD5

    73b4318db514a40d8561d7430457678d

    SHA1

    16a734c183cd6df449a58cdcc0997e01ee241052

    SHA256

    3c277292ec24b118dde2746ee7382470c4a0c6a37351757dde5076c45cd69882

    SHA512

    d7c03c1360ea54c2d2e5478bf37b9877061a018f802c6afbdc7142f9a3f6506db7923e2a381f021608a10f580bb412634b8cfece16d2e157e231ac09c5ddcfda

  • /storage/emulated/0/.androidmonitor/prog_class.name

    Filesize

    10B

    MD5

    fd5b98ea58e94fffa1df623df684d3b4

    SHA1

    eaf9952ebeeeee38df60c9648aa728f2d2f7a52a

    SHA256

    73a03ccf7af8d3e9a1270d54680f56749588fb49511b94a424970acf69908d59

    SHA512

    9009ead16766df475cbe0cbde7329aa905512f833b938194603242efc9f33d88ee441495066f66ed0dce55f4d5248fb3bd66233e3176c57ede357663ad705718