ad031c7b1e72c6d0af9cf28f8909cf80e044531464da2275ee34aae628d93c53

Analysis

max time kernel
40s
max time network
65s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
13/09/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
128.apk
Size 4.4MB
Sample260913-w5nbaack71
SHA256 ad031c7b1e72c6d0af9cf28f8909cf80e044531464da2275ee34aae628d93c53
MD5 4500140c4e9799065758cfea26c513f8
SHA1 a097c8bdc412a558e5abfaadef2d40698fa45381
SHA512 2f70f9ffc9e3c77d0c96d1750ecefa754fced7faaeb8c0064958c0a3c228a4f79438de03fa0a6d8213ab119eeada49adb35875cce56e3f513e9d8f01098e10f0
SSDEEP 98304:bTQak5ooPr5NV/yI7UQvtN8cAppE8orhzZYpCZ+xrFJb3s:372Pr5NpyqLv0m8otzZYpCCb3s
TLSH
T10A26E087F758992FC8B350F24D6E5272164B4C528E839B477D48372C28776E82F89BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery evasion execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.dm.bomber
/system/xbin/su	com.dm.bomber

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4782	com.dm.bomber
/system_ext/framework/androidx.window.sidecar.jar	4782	com.dm.bomber

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dm.bomber

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
49	raw.githubusercontent.com
50	raw.githubusercontent.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dm.bomber

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.dm.bomber

com.dm.bomber
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
PID:4782

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bbb9a02d9bbc77c9e8c21f11b58a9d4be7a40acb1121176eaa911c0838e13c53.0.tmp

Path /data/data/com.dm.bomber/cache/image_manager_disk_cache/bbb9a02d9bbc77c9e8c21f11b58a9d4be7a40acb1121176eaa911c0838e13c53.0.tmp
Size 102KB
SHA256 8e766b0c7404e56cf1e8c315a2dc4c95fd777909372ca38401953148d7a9bd32
MD5 2933468df7f1bc252c1b6cae7fdc177f
SHA1 b75a3b572026064c8146b9ac33bfee48d76373b8
SHA512 3427b0164feaa129c69d16de650396cb198a9c5c2b39bd147be1028525b70d7600964b13738510310e7d496a29877c6c4a61f2ca1f023e408f05764afb12a14f
SSDEEP 1536:JQqTkHVqAGtEe5dbh6NYXeTIPLaaS1SOS2/ovM8sahhzzZ90so3DfKV4K7rUNie0:NYqAgEe5dl6NYOTIP+DgV20ur4n7Fe0
TLSH
T1B6A3120374A85B99CF6EEE3752BE5A04638D33F82C2ED74D6016D940874A75634E12FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journal

Path /data/data/com.dm.bomber/cache/image_manager_disk_cache/journal
Size 180B
SHA256 a580d3a588587589170f7710d34878322584720e5615f6154738b429324f6393
MD5 4ee64bc6bd409c8803f061226eee721d
SHA1 9eeb2ebebffd22a52eb86294caf7eed9bac93b00
SHA512 4e909ec43cbb1ed0c85667c41307b3c684e297378f6deb26a1b0a84bd79c19b4975a810b14555c75151883baecdd0c0987428fe7eb4b1a09a5b1c6e1f99bbd59
TLSH
T147C080BCB40C05DAE5C6C031D040755C5304FF40408583F74D0517D511153D071C74C7
MD5 SHA1 SHA512 TLSH

Submit Download

journal.tmp

Path /data/data/com.dm.bomber/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events
Size 56KB
SHA256 339d47465411a692db65903a30d0bbc5d92268463707de0ff4dd23f01d63300b
MD5 b20381429d495f05abbe6bdf1631cabd
SHA1 f4ee7dcc5a7ce69817fe3da1f6a14183b21b42cb
SHA512 6888a4bd19757735c40db3b88058ea9a059eb52c38161e0d24a76737df7b6c171872bc84d60a0c1c05deb356e09c6f8994fb0db03e45fbb4f5b646dfd84030aa
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPScyFXfb7tFXfbs:WMEqzAiwIyNjacAb7jbs
TLSH
T1A243865D4A3C2221C66D783DD7E243A36B7C83DF5722D2A53D944DE6CCC20667C214A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 0072d387872f6fd8b2c99ba1005a57d92d465de16f39992f801e1b9ed9fe57a6
MD5 9f37c91d8e9886a9fd8b808a39049d76
SHA1 3f11200954c3d9f1d885c5e682d9db0751f54857
SHA512 e2d15a15bc58c60d743fa595536287951f69395a15581d7aaf25d129c8c4a8858dc794cce149448b5d6b488064687fa31f965e9ab1ead6a4c6d772f643577247
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 83d456dd001b0a4daa66f9359ea455aa93ecf7d8e895bf3c3ea8c18c96f5c4c0
MD5 dd3fa859b460537d924931a3711c31ed
SHA1 4581f2354c09cefda66bc49af3f31071c30a5049
SHA512 5d8ff30a420400f836b6018ad005c921b640d8d77a1e8a8fcc445f5c31297a05dc6f4dfffaeedefe0ec997715493b12425911a0055bba9c1c3a758385d0ab41d
SSDEEP 48:7Mp0qG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS6:7s09MEqzAiwIyNja6
TLSH
T1B6B2576C5D3C2611C5BE287ED7E142A35E3C53DF9723A1603D948CEA8DC246570355AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 154b8679914ccaa4e5c1b1a47d31ffcd935bab24a47b9406d0ea2376caf6d3d6
MD5 168dce9c6466d34dd96a7e647ba2185e
SHA1 dbef73a76b9dae3a34a083cdbc4528c9e6a15170
SHA512 32b5927f18d6f1f706bacd27cf9d48b2a4fc94aeb49db740416c16e8a292965872df31251870907a25df2195e495c90f84774c8dde44ca4db299f63f74e3ed71
SSDEEP 96:7sULtz3+UqjKXoXkZkGpitMEqzAiwIyNjae:7FsjKYMpgX3v
TLSH
T14372DA9DAD3C1131C2BD757DE3E106535E3C139F6B13916439E88DA88EC746970264BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 29d7d61fb7fdd2c7220f32c0be96e75e072a4110ec1126057166c036035868c1
MD5 92e7dfaaea87319dc3a3b94c609b26c8
SHA1 b656fb852fb80f5b1d9fa8c19abb08bb36a06bb0
SHA512 c1c9d9729c253372b495c8f20acf8e73b8478f385af78ba75c44c39fa07fe8784b3fe0608868be9e63f4c0aead85ea478db12dbb604e71f8153e05f56392e2e7
SSDEEP 48:7M3VFXfb1qW59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPS+VvqTq59MENkMwb:7Mb1NMEqzAiwIyNja4dMEqzAiwIyNjap
TLSH
T1B292849D5D3C2311C6BE287ED3E243A35E3C53DF572391603EA49CEACDC2469B0255AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 e38271cc9e0ab8d16f1dc2b01765111fc2133103914dee4540fc9c851627bd76
MD5 7eb2c061f9c96b9baf73c6aa22bc50e7
SHA1 3ca98621951d87fcdc25b3162efa2d8b4ddcc96b
SHA512 26cefdc8c51a6714289d0297c78f63257200814258e03ee13ecd679b960e1fc7bf8b3e9a51cb79af8e54ae89c2506ccf22417e2f120787a92c56c68f2989bb81
SSDEEP 6:7+/l9YVn1/g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKg:7+tgqLiuWdYRmBEyPbf
TLSH
T15702C08C6F810813C83D177F90D483400D20E729C1B5CB9BD79108947C0B7CCE4E0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.dm.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 6dd1f26099c8f35621b0814e00aeda9638a7104558a961a0b6f74f93a4a0db82
MD5 b34e3fbc2c61bd13091291d5f308ecc5
SHA1 bd4110d447166bf442e1564bce0dfb7786ad015a
SHA512 061aa76a6c12db8dd33149dfa01d52c301dd753a09c88ec84d108dc0f5af49cca93dd8bc700f28579faf23adb3a8cb4928780bfcf75912319d005ca981950e61
SSDEEP 6:7+/l9lPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKa/W:7+tfqLJdeWRmBEyPbhW
TLSH
T16002228A63400813C12A3B77A0DA83801E24EB289323CB075E9118B53C0A6CCA894E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dm.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 fecda2e650a2cbb3652d60ee1843b2e8fa9858bab765aee964b59b80a73d5c97
MD5 db36daef009d2615bbd9dfdb4f4d871b
SHA1 48f15ced1db6f00a2e1082ff632fb87d27b4b8df
SHA512 bb61280afeb208d4ef43224b9f871d09eeb24a4660c2b6691f5893f459871eff4ef4a537a3d0df268fa51e74bc55a76ade599d398f6d58fde4975adb8e8b70d6
SSDEEP 6:l9bNFleLIls13FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwa:TLDE17LzmzsRmBEyPbBvOwVQ
TLSH
T1E272D8CD8F10A206C5270337608AD3954F78551E936796472BA408615E52198B051EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dm.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 beda3ad1becafac07615c745257c19301cdcbf4a2ae65bdddf5743632dd03fed
MD5 59845746395a3d7b0346af645f667c0d
SHA1 3b3e1e8ce11a30ab9d7f2c4d7dcc4b553df7cc0a
SHA512 ad13d031affd6e6ece08dc0ded974d57586c7dca681f19381c0484970c333ab9b481bd76312c47c84435849733fbcfcb4f0b20fb289651496c5a1c20c9c2913a
SSDEEP 12:TL6Ee7LzmzsRmBEyPbP/DvJ+/0Fl6xI3HL:TLwHmz3GSP/DvJlFOI7
TLSH
T16F722BCCAE10E603E177473A60CBA3E61E3C611E4367965B3A6509749D532C8B152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dm.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 b88910fc44f508822051d2162c56d662a5babd00de7ac6d5bf64f857b80e51a6
MD5 0fd668c209bfec4aac827a77c6c1d88c
SHA1 9e1ed50123931202a7daef819d7b4736ed01bf48
SHA512 a488ea770325c51ea655c2713443de2cbe3665cd3e82284209f6b36b5a20acd8f9be574a1ee008274af7739133954edc9c94f18b8e3e76cb1757d1b92ea294e7
SSDEEP 12:TL6UEr7LzmzsRmBEyPbP/h1V49blqYFl286bvJ+/0Fl6xI3HL:TL6fHmz3GSP/h1V499FNwvJlFOI7
TLSH
T1DD724089BA24E642E2774B3920CBA3D22A3C702B472796163A554F2C5C833C8A061F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dm.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 cca4d658bc0de831c75280851d8eeb156132ca3dc3d873ba048479b22fc68836
MD5 19b7ab4b1d90e6c2fe732e4b5e36cc72
SHA1 69db925c9d642c1c20a6122c2adbf848f88715b5
SHA512 fed828df2d7effb97dbb2b9332bb01008615dc443f51e15df5c266fa00fe60187bd65b1571fe16109377759c8242050d081013a164fe99416fdf62f8ddc0463e
SSDEEP 24:TLQHmz3GSP/RKabCCb47F499FNwvJlFOI7:T0GKSP/MabCCb4e5NA1OI7
TLSH
T189722489B978D652F2B78B3D11CBE3C62A3C306B4727E31739565B2C6D933C4A061B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dm.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 3d1e8c0e37c1d1546f5959e4d26d756658c3ed8f56bacb2885e23f59d63a5dcd
MD5 3cd97711d4525fd6e8f14898ca3c02d5
SHA1 56b430df5aada3b399c680ad48c085cd77319510
SHA512 22083334f5ee1ca9656bebd53fe991d1ba8aa082109d2444fbbb892463494a9a2141fb5b40e58b8d747a75df86b03605396390351ce18a9feef5bbe6507df237
SSDEEP 24:TL0tHmz3GSP/IxKabCCb47F499FNwvJlFOIZ:TkGKSP/IsabCCb4e5NA1OIZ
TLSH
T19F722489BA78D652F2BB8B3D61C7F3D2293C30674327E31239565B2C6D433C4A161B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.dm.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 a0f17e1763369e8e89135eb9ab3e4059a1316fca0dd10ed66503253e48d33190
MD5 8d017947e8af0d37237404b3cd2e5e9f
SHA1 6b64fbb2518fe40af089ea9620699aaaf1d650a4
SHA512 209ebc4525bdff07e23c0b0632d3766a610c5c7e8b7e8e3216cc9a710a712e5bb7f8faa0a3470c310ce4fb509b6ddc53ef9fa5dfdbe0474e34d69c0969ef7d0d
SSDEEP 6:l9bNFlgls10l/FP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WS//:TLuE0l97LzmzsRmBEyPbP/Wy
TLSH
T1A77226CD8F10A206C1670B3AB4CA53961F28612E8377AA472BA40868AE531D8B091F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download