Analysis
-
max time kernel
129s -
max time network
138s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
25-11-2024 23:32
Behavioral task
behavioral1
Sample
9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
9e8aa2476bcdc551a33326f57f15b185_JaffaCakes118.apk
-
Size
14.4MB
-
MD5
9e8aa2476bcdc551a33326f57f15b185
-
SHA1
27564a325ffe51f45928d958572bb00c20e2486b
-
SHA256
451a50c3f405e1c3f3a71c8c04f705a30c44737d22cc6fe374c9bdb8f7b4c5f7
-
SHA512
d8567465e1325af5aac56c4fa383d67ff104af16b39c089b777426571d46573442204466474b910ed9b38d1166a6d808126b6131f4250dc3890b8bf63c13953c
-
SSDEEP
393216:1UuNEt4HEep5BViqsS5vLwuUT0pvWPRtqOJePLkhIG:+uQinpjgqvvLPr1WzNJejkhT
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.dromonioc process /system/app/Superuser.apk com.dromon /system/xbin/su com.dromon -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.dromondescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.dromon -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 4 IoCs
Processes:
flow ioc 29 prog-money.com 32 andmon.name 33 anmon.name 24 android-monitor.ru -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.dromondescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.dromon -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dromon -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.dromondescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dromon -
Reads information about phone network operator. 1 TTPs
-
Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS com.dromon -
Tries to add a device administrator. 2 TTPs 1 IoCs
Processes:
com.dromondescription ioc process Intent action android.app.action.ADD_DEVICE_ADMIN com.dromon -
Checks the presence of a debugger
-
Checks memory information 2 TTPs 1 IoCs
Processes:
com.dromondescription ioc process File opened for read /proc/meminfo com.dromon
Processes
-
com.dromon1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Tries to add a device administrator.
- Checks memory information
PID:4643
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Foreground Persistence
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5fc95dae313ac0760c1e54534d676e5c4
SHA16908651ddb656a8017a52f56deba98de4e851db8
SHA256fea008a23939ee1dc3a461a9a4aa13d6b71df11d1129389c21c36931b86b5852
SHA512041b165af3cb3a9e54a05b93f9c9a7b6a551873d43187ab51b746b030863bfaa5985acdfa26764f115855334753b9bc4d3867f5da640db0c1f2d2303343e8b5e
-
Filesize
20KB
MD535779096718e5332358f4c6559241932
SHA147e21005e8c38b464053292c794e1074acb9f54c
SHA2569265bfd181291801656acb313c57c6677d07b809ed04d12612da43516c502dc7
SHA512d967067bbcdcfcd3c2eb273191b68429fdcd37ca47174bf550df3176d309298202fdfae80a366d3a2fd82f8b42c68075e3317bd5ce2044cc1bdc21d0c4d38588
-
Filesize
132KB
MD53ecf91128cfcf0f9caba8db88fdab7bc
SHA15b33d574297551c0c5305f6a344166a7cf07ae06
SHA25671236d94f3f1aadb23e652d05cfe9d0c656e78765515502cea3753b4d7c5a483
SHA5124a7e4df0dfc9ad8d0c1ad5abfac125131526acd86532acd7961fa306e59d35b02e2c2bd48ac4fe9a14c0b8f409331bd8ec132d1e78e3bf19464fdaec56cfb2dc
-
Filesize
68KB
MD5002d37a9545f742d4d69ca1ab25c59e5
SHA1b4433e52c2be1fbe45c4ef0d94c333c991bcab50
SHA2562e6aa55e0b0a42c347395dd86befab11b32a324f66127ea0080a94581dd18a7d
SHA512eeafc24c9f921405638ab35ab9508e1476f199eeb10dd5fe0a9426cea1317d9aebb29f605af2eaed79ea3f5440909487999b1aa0a67808574dd94530ca18dcd1
-
Filesize
68KB
MD54f89bee8311851d72f8a3e0fcc501693
SHA143a874890620ff9a6ba2de76b2e9cae8f2dafa46
SHA256a260d12347a9d506fd74ba4b42a74e08e8edbc18eb83c440b58367f29cc6da17
SHA512e5e4c41215d818c51f651a93404a63b5b48ea6c51bd1ae08c158c0caac117ec53508c2a426979310d4106d5e948b082b90374e46a00cc83abd665ab0d255363a
-
Filesize
84KB
MD5453abd62cd582a3c172404955989aad2
SHA1b00e88f8e4e579d2b34e46456ea6868dfe05d885
SHA256c83729d3898620c31cc0bc5b9b57d7ceb23d4311e39bca6efb6b9492107bf9ca
SHA51211a0a4335c9fd5615f7ddf1c1373745f696e01458019665260a7fccf51014454cc9691f0a289ec16ba0b7e47f36e1d0d8bc396419457ea0b6945b0887c4851c6
-
Filesize
512B
MD543a9f277d906b64e7c0298f1c61fd98d
SHA1fc2ca1faecf1595a7714e3502f2adaa0417592d6
SHA256c892b8b81e681effce5b4fa9b2ce17a017328c1aea94048e6aa18379aa91ed36
SHA512cbf8ac60ab98878d4695a6b288bc7c3cb92b556f2eb392f37e060aacc507623b1a91424b3401f6e8c6d1c05b43aea551ed5f65a69b4b8f15287e13162bcf9768
-
Filesize
8KB
MD58be3b7d0da513d34cc3e3b3d570127bb
SHA1a01cb1cf93bb4718105afc9cde2602043d6307be
SHA256607605c4db6bb65916ee8fd41b09e5dc43a5d1808f7bd4c608959c6174b3aa44
SHA51263d20d7612c4d7bebf7b6c12d7fae85371d6195be5908dab58685b1eec50e2b9407aad5085738e2be11e82a02f001d8d913e5fdc803b286d62f445baf4de91f5
-
Filesize
4KB
MD5c434a8cb818b7baced3adde3fc193300
SHA16b5f631e6b1d38f4a4229694426aaddfc8d8f0a1
SHA256cc45bacdb7393affc3a3ae361820d102f60b40dc3cc8cdb464439bb768f93a57
SHA512352213fcf92d882696ed7b4f1dc59be68c9600e7d12aecfa04a6f44715e0c1b5410e65e7b57e57094b4dcd4d36cf57626761cd3c5bf36640ccde51ce729fd614
-
Filesize
8KB
MD5b4b964ebe25e4ec0243bfe08ff8779f2
SHA1e01ef4fe05cff374bcc3ccef39803b85e403ccb3
SHA256f10d8cba42604537de4e1a73bb198f5bcdb6b4bf3aabd56ff6c15a6844d0d71f
SHA5123845565ae1904605f2210cad0c008ac0ead19b1caa64582d27d6ae8d968aeb7b2df45fdfd190918af7e4ec903b4b861a1ad56147778cc9470c7ba2d27d696d6f
-
Filesize
8KB
MD5d871506d70d2a88359d2c301133def0d
SHA1dac6223fde5546d1ffbce2fda52768d25baffcdc
SHA256b9a60131d30dade99f7cef2f0d63d8122c0d4b1ee0ec22914ce5f041861fec36
SHA5122a1fab3b3149e2f757b498115c19c911ae94a0b6b1fb43be6e3d8fefdf22c77e9eb37b1d1238f25f8e04dc9ecf9c9bd99f752cb7b5ec9ccf236c2287b9f9575c
-
Filesize
24KB
MD5659c32d889775e89d5ed5d429c8cac45
SHA1c55d87f3b8acbb2cf237ea9ecce5e164206cf8c8
SHA2562329e15ca7b2c6a88650054067676cc3e0ecfaf62de2c66ea92a4d843602a43a
SHA512c22893c3cbf46d57c3679b890f4370887b706b595c39739b02ab4599eadd83de57b974492a12abf4929ec50e94b00120dc69bf01af1cc410be7435b5850a9d04
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CBeginSession.cls_temp
Filesize78B
MD567b579e9bcf7e2ebc051c2cabb8d0df3
SHA139570d4b9705cc7015c4ee8817291b72fe5467da
SHA2562169a41caa095501978b87319518ff4dc131548136658a0a8705c12a61150963
SHA512f0eb5d604870d1b58d3cae8c21550970d8125431494b6fd7cc2e1d5c017e44578ce369126cea7b4c645739eac25757fedca329335fa13ebf242dfd7843490367
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CSessionApp.cls_temp
Filesize103B
MD59b74cda06743fea3d75b6cd404557b6f
SHA1279c0836908920509daceddc299458b81d832a83
SHA256884fce23635df88e4dce0d36dcb2798755ed1aff83af72dc6a7b1d1ff66e68eb
SHA512b7281e5020d598a2f42113b9014aed6653da4edb879ac965adbdc90b3acd316e3b7f167741ec500917f2fc439782cd924deb211d9558d4cbc9794c9f3e126f1e
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CSessionDevice.cls_temp
Filesize131B
MD5e7b401ef2d5fb18e1dec8a64a9f096b1
SHA1dedee24edfab2677d62e8f468edfd5f63565b4e5
SHA25600c99d56ba55451e69e673a5cc68bf656164b17e42e500897231358e3f9bfc30
SHA512eeee378f55407e3961ae9abccc917f0fcac3b8fbdef083273d98b089738efd957d2aada2f39f0180f3cb08846fff8d0391e52e498c78ca9b3ac063b0d1813bf9
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3CSessionOS.cls_temp
Filesize15B
MD5b3d9541cc92a9153d14e5160f8d8c008
SHA12e1ac80eb381dd82a03795b682f92020348c0113
SHA2561ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d
SHA51278074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3Cuser.meta
Filesize29B
MD56f3bf9dd98b2e511bff7eb204ec6d254
SHA1b1eaafe8cddf7b98783a095a725d6fc768133d00
SHA256b2eb715b3b4b639f36fedce1ae2d09233544a0c234821be07f96f16adc0659d6
SHA5120bb7d5e43f6441afd011935a0edb8a8482e169f10e3860ca4b70418aebb7866138fb2f257c72bbe66b9f736a9898fe226b1673c8e11bc6c9845b4821877ea372
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/67450907010A-0001-1223-3634128E0C3Cuser.meta
Filesize47B
MD5fc144e611da462ed2c0aa3aa355698f6
SHA1ab574d0a0c2a2d2facdd725509f0df60fda6e011
SHA25632482b6a4b7a6f806e6ef7e4b407e910fcb188507fb0c3d3dd1af5e95c75d86e
SHA512fb6e0cb39e8a3e0b847796ef8e1da209e9c33dbed5dd1b193cf1a14c24be364548358341e583bda6e27612a56c4865f15d91897a0a7591ecac243e6cc3a895e5
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-67450907010A-0001-1223-3634128E0C3C.temp
Filesize88B
MD54f17a6f173cf19db5168267bff8f89c4
SHA10353e336960b84a7d7242cc13e57838ac95bdea9
SHA256e6bc7ecc05935d258fa072c44d63f6faa558038fc2a82042b94eca76a0e3355e
SHA51240a4e95d4d95ec6e541c5f81b1b2696d62d8a064b384c3321bb455516400bcb0011b4160d72eb95544126c47f3b386936f986a193851289457a5ac230b4408e6
-
Filesize
465B
MD51f5cf48a84db522deca645aff93361f2
SHA13c87dad115bc94f72cabafee27dc5432b115a787
SHA2561b952be9e89bed02c6ebc66d803c66f0b2127e6a97a4d574452329ad2a1a1896
SHA5126fe239fcb150408a2dc82e15df73c5a53358a65c2048fae7e53b5dc78db32ed609f0800f65f2c03b350f19568a5ed410de8bdb63ffb529bec892074a84c1a511
-
Filesize
1KB
MD5afde4d99c1acf5199a251d162b97271f
SHA13330f170eee45740479b057d553d004ca24fc16f
SHA256997ff399e420a58bdfd62f0f8a25133bb2816664e2d5ff1b5b0b5f122cf0ec47
SHA512338f59f34c1e1715f3039d5982fdf59d6d82d812535432daa839254e364edf084a2d735f77eaf93ecac4a9032d38be01484f983db62716e1458932859538acf9
-
Filesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_3ece8049-c459-4a37-8d75-94cf18b156aa_1732577544919.tap
Filesize364B
MD57460cf904d6ff695263f23124086ce30
SHA159bd5a637593344a28dbb442c6ac4c056e31b4f8
SHA2561d1796b9bdcd4e031cc8593718188d34255d9264436e5523dd2b9d94e499a4e8
SHA51256269317efb207de3d7354d1d211d56679ab926797886980153afe94d6400d5f0b3e630a39df3a59a346bd9d8dad94c1188a43b16f37678efabf500f0d6c2831
-
/data/user/0/com.dromon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_9a259351-ad9b-4f9f-b452-18d7fab89a52_1732577555162.tap
Filesize449B
MD5d86308c2620ea3ddbb4311f0c9127c25
SHA1e3de71cbcbc52c0b8b052c7e4375a3d2a86970a6
SHA256fdac031d0f9f449eb148406147831c0eebc00b276dbb9772132f0edc5d4a6e71
SHA5120add77888e75cc6d88fb347d5289c8ef2af7ca163d9910912266d67f4ba80bda86d5a6de2e7f2fe62e1b0b2ad188d1228009ad07b9a91d2044fc5d41bca924ef
-
Filesize
46B
MD5e9d79fb4c4cad632e05874765011366a
SHA1a07cd59d609615dabb85a0075bfe51255e48c897
SHA256fee63a4a71adb94f469f203b506e16787cef72e8e6c6b878b73f3ff449dca67a
SHA51270cb50621c98d9ea79122d8ca6401cb53418c8df1162f5812f9b2666b8a4545ea11a6546f76a56795eeda10c4f766eef479051268758467766b2728a767d4ee2
-
Filesize
59B
MD5a092942a80894646abd2acfd93671e4d
SHA1d98a21b09d9aadb12a9491226836b28b57780af4
SHA2565e955a4d65c79d2db45ade0b18a8ebc5184e2e128badba1e6175384bdd30332a
SHA5125b4e57dda174a533f0859dfec48a043563961aeeb7df55d53c0e7d3c95bf00dfa54078594eb8aeffc8defb48b0c1e10ac768bfa4c3ad17f2bf2c6086aa4e39b5
-
Filesize
126B
MD5db79d858b8d594a3ab0b38657f0ce846
SHA1b74f1dc0ff766729cf9e7238acd2731d873119c3
SHA2565c3129c15542481d9fe8137ebd6cbcbefe52133eb4447797a31f383c05710a00
SHA512402df37d37f1ff1d7952f6f43c7a387f2aeb6069c234e6a11aad6dda0ade686a0782fbcf0d2b542bafe2913afea604b7dc86b01c9997288a9c102cca7803e62c
-
Filesize
74B
MD54f0a1ce0e05471530444e8a73dc554cb
SHA138407ad8ca28978599b5d0731c0e49b22e48f7fd
SHA256cfcdbe6c0b1c516fba53142aa01815868ff8ba3c3e4042beae61c267453524e1
SHA512e062e9e3470ef5dbfe988ff0ab62be2036c51ea43a41769a80bd60143488588ec3093f08a45ef024708b2388a771911547a9f8351d260b466b3632d47d5d7f0e
-
Filesize
55B
MD552d21b7daf4a192561bdd7792bb0d852
SHA18d903e8f699d8b83b0c180770ccd9f792eb652f8
SHA25697532829b88a7d57235db74896b2d9a90d579b1f7a9698965a1f12f71c143040
SHA5125118c90ecf1cc21caa693d80a50e75b1e89f8ec45f650f23975872a5b19da294be41fe2dfe6198089130aae5c36dec9477395987365218617ecdc67ea8fbcb9f
-
Filesize
48B
MD5098bf7a610a7400835401c8fc0f24f41
SHA1774a60e4057b7352d48a6ca1dc07bfb886dd3496
SHA256a3934466cab6aabee703c53379b91f7aaa10e1ced17bfa018781d9a53c961def
SHA5124715f4a758e7d3d8f331fc84a0aacc23c75b4cd186dc44ea69b87ab7b8ca7b080ddf1ebb6e70fb3fcb4c6d2f06ec44026439203fca0061bbaffec7fdd8a9a12f
-
Filesize
850B
MD5b7d38ba2726d5ad28a849bce96048805
SHA126bcc08a56e77ee993451744a1cae1b83d16b94a
SHA256905c422b326e7c5910e9e7449233daec1c85e2a51f9a0761d91044fd88c34538
SHA51216dd1ab47c38ba3163db97ef58bccacfdccb3ab1a6096e01d7f3cfdf5cd9d340f0a9009930b59c91e835db79b0058675fde6d1a140223be50407e1e4529ade6f
-
Filesize
5KB
MD57fc9433a62f79e67839ccf8c07c211ba
SHA1ee6801d6674cb1fae2365cb6cee3df9067c658cc
SHA256a49e07edc884523128cbf3c24a8b9769cb396c0da0c5c9ce862d33d7ac904349
SHA512e5297860d7ad594e35b1732732c8d310b933d9b0bbb44c07c15fc6bd99c5ba8ce7be5703048b4152ee4054823e415552e77f5ab84c764e72ab0b1ef340a3be25
-
Filesize
1KB
MD51fa5b36ebb6a3add4e151b4ef027de7d
SHA11fc63029ee6f91b04a88633ffe6e398f5ef364d4
SHA2563aa9ca365928bd3ae6a4204c2269a641360fcf68c3ea1651722c3d3a2d878d12
SHA512886f65a94f485135be4368d49131973a686cfae113482c32a559b5c6e126ef0d5180f1d86bffcca6c50fdd92812b60d552a86de5b9d6e9fcf20d45c4a4a90291
-
Filesize
204B
MD55a1682b8311b05888e39217e4b5f6b13
SHA16dd95639cb5c67077fc82b6f918202eec05cc849
SHA2565dc229db97ff83df40cfcc97b677b84b6f9a5e35dc54ca92e426417fd5b2bd99
SHA5129319dce1de6eadb6800e4c61503e41c88f1d6a1f1761cdabdfd9d1781f342e7d26faf5542fa3921ada17395998f8e302dd26285fe6405fa70a32fcb3b5193fbb
-
Filesize
249B
MD573b4318db514a40d8561d7430457678d
SHA116a734c183cd6df449a58cdcc0997e01ee241052
SHA2563c277292ec24b118dde2746ee7382470c4a0c6a37351757dde5076c45cd69882
SHA512d7c03c1360ea54c2d2e5478bf37b9877061a018f802c6afbdc7142f9a3f6506db7923e2a381f021608a10f580bb412634b8cfece16d2e157e231ac09c5ddcfda
-
Filesize
10B
MD5fd5b98ea58e94fffa1df623df684d3b4
SHA1eaf9952ebeeeee38df60c9648aa728f2d2f7a52a
SHA25673a03ccf7af8d3e9a1270d54680f56749588fb49511b94a424970acf69908d59
SHA5129009ead16766df475cbe0cbde7329aa905512f833b938194603242efc9f33d88ee441495066f66ed0dce55f4d5248fb3bd66233e3176c57ede357663ad705718