dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde

Resubmissions

12/10/2026, 17:36

261012-v6lneadt2x10

12/10/2026, 12:52

261012-p4cptsch4810

Analysis

user interaction
yes
max time kernel
292s
max time network
297s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
12/10/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bomber_v8_signed.apk_Binded.apk
Size 6.4MB
Sample261012-p4cptsch48
SHA256 dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde
MD5 680a1958889a2912c2c21883b69c5dcf
SHA1 a7b8d87c08236d99d4d6b3b829ec4673a47d4ca2
SHA512 149a35b2dcd1bfd82cf79a0c41e493da2bd28eb7f0964514bf6bc0b368511bb9ef1a0fd05a75218e2df34d1db63ba82157a0994379aa06463902420682e6903d
SSDEEP 196608:3btaeYyie32OCJEEWAU0WtrkaQTfC91qDv:3bSyieGOCJEDZhQTLb
TLSH
T1A666D056FB48A92BC4F343764D7A1223650B4C268753C7D7AD04727C28B7AD0CE9AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	cc.bomber
/system/xbin/su	cc.bomber

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4894	cc.bomber
/system_ext/framework/androidx.window.sidecar.jar	4894	cc.bomber

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cc.bomber

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	cc.bomber

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cc.bomber

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cc.bomber

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cc.bomber

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cc.bomber

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	cc.bomber

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cc.bomber

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cc.bomber

cc.bomber
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4894

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

primary.prof

Path /data/misc/profiles/cur/0/cc.bomber/primary.prof
Size 2KB
SHA256 fd24fdec96ae4a0f4c2362c1a8fc1f16f29bee9b352610e8b259203c20378925
MD5 0be384b044e954bfa2d7d5880f2b8b1a
SHA1 bebb39321846c134102cea00a7e743019ba7ffb8
SHA512 5b9dd7057bb440eaecf6fec86eb9195924b82e82f54a3926fb618b612c99c239fd2b7b1d968a5cf12391acd7509c920e0a5b6ec65e12888d69c9ac5c825e4f18
TLSH
T148518E62E757BDA04FE7A21827D63D3D6D104124BE924E4075D213DF6C883CC9B46382
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cc.bomber/primary.prof
Size 12KB
SHA256 d9961a8f2c5480c62dc0dc010edb5fdf711fd8d9b2e363a71454a937ae1b2856
MD5 8d6a199239ca1b4246651aa32f55807c
SHA1 ebc7df99ce857d2533bfd60fa493a0a521050790
SHA512 5914a2595ff716b1b5e923e9bc68ed739270d39260ac6cf608be836a53cb870fe8c38a587ffd17ebd9923eeef2bb57e955bee5c779b0efbb33d7b019fa8b3012
SSDEEP 384:j6ytMNVT22foDLCgpfU+0EH77j6Wt73s5dYudagy3Q:my+/oDLhpf+0yG85xUQ
TLSH
T1D742CF1AD55F3CB211A43E4FE80C93CEF21A169FB8F0A670590DD18431A5789666F4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events
Size 56KB
SHA256 ded9853f5e79c4c2e658f5d925ddc11dc5ad47dcec6b6779a39db80c1d35aecd
MD5 61212ecc25bb0618cfe07a0d07bcd360
SHA1 af885a314c7e44a836717645f65356410ea4c484
SHA512 09dc1a1152975ae6f8e06cae18a6d8801b908c5a23d6924bff9bc6d5462c3aa2adee2d7a7746de95add0e615033b91306bd6b92c9ab04c962e1df7abdb3759a1
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSZKjFXfb7tFXfbo:WMEqzAiwIyNjaZKRb7jbo
TLSH
T15343659D5B3C3221CA6D683DD7E243A32A7C83CF977292213A945DE6CDC20657C354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 7d144e70a6d8a1b6aeb9458ca44377debfe02ab29255682e62b3d3ebc48b0c8d
MD5 dc51d8b26803f13dbc25f8ec98c1d898
SHA1 7c4680867d3cc3027c4854cf1e8e6e3aecc949f6
SHA512 7e27f623a56695e1ecf49fa67897203ce9bb2283618d07e4609c834319623c80eef1dcdd49b3f0f68ae576a575ac068830e466c1de8639137240338366edcf2f
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 6200a45ba46498ab31fe3319964b107a4161d048811133c53022c0462f4fbed5
MD5 5f5db8edbf9815f6d1527a60c5e0f369
SHA1 4c07480b74dcd7cd97f959c52075abe5f07a1be1
SHA512 45f47bf6219f4d086fad2fead1b7f5919ff4040d04b61e8f77225f4b443b3f34d4bc7ca4f2f3d6e849e3bb90f5a926436210f9c357fe14084892128217e7caa8
SSDEEP 48:7MkVbqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSu:7pVb9MEqzAiwIyNjau
TLSH
T124B2745C1D3C2210C5BE683ED7E203539D3C53DF5B23A1603EA48CEB8DC6569B0254AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 1d62243a7220e3f86010ebbd5a5d27800fca085637dbd3ead105a9f97410f162
MD5 14a09a10d1618a40757ff31a54c79129
SHA1 e498db1d2c9b69b759741fed99d22691a088b044
SHA512 0b3bd0fa2db4453795a25de292966c086e597077862be8a5e78d91bfeb9143b941fd85d4104bf3f485aad4ffe3d40eac7c5544d911abc75bd15798b687a5034e
SSDEEP 96:73ElTjc7UpwqXRoXR9nnGpntMEqzAiwIyNjaV:7e1wqO7GhX3Y
TLSH
T1BE72B84DAD3C2632C2AD653EE7E115531E3C139F6B23616439F88DA88EC60AD713749E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 932adbd71d653550bada4f74723f6204d86773ebc30506651fc89d075dd96a39
MD5 13fe9e280bbc945888d24a031418de30
SHA1 3085a039cd2191b0e0e08e7656fb084cae50b878
SHA512 588ac0d95008fa3b04099ba8994b57a4fecf77786dadc08e4c66ac0bc52cdc554a7968d0eccb0300cf1176d37c4fe9cacfe90b7a1b9d1e4ef0832b1c3124f523
SSDEEP 48:7MoVFXfbWfqW59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSbVKqTq59MENkM4:7RbaNMEqzAiwIyNja0dMEqzAiwIyNjaJ
TLSH
T1AC92749D5D3C2311C6BE287ED3E243A35E3C53DF572391603EA49CEACDC2469B0255AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 268c589d3880e2b454b2e6bcb3d243eb66c4debcbddf2151e7bb8a7659765ec6
MD5 dd9faa4fca3151aead4aa1caf8a57709
SHA1 51ed028631ac51bcd32025a8f0f700f770b845fe
SHA512 59d6bce38e4e7addbaed7a51149059a4151e310466984d1b6c6bd5c42c011a81d31962b6ef5e059f72ace53d1ffc8a243835ecec7222c10e8657388d699e3484
SSDEEP 6:7+/l93Cn1tg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKsj:7+tVWqLiuWdYRmBEyPbR
TLSH
T1D802C08C73810813C82D16F790DC83400D00E73C91F1CB17169008943D474CCF4B0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 609ee17da0de3c8abbd1c218d835ae8203464d09b1db8cdf12d3694b3d53bda1
MD5 b79f0bdeaabcb6035d5295f82f2a4b5d
SHA1 c761d61268b9b84beecd0bb8fd8f0fd5b8fb49ce
SHA512 803a4e3636466d8464212a4ec30a16e9a47f47c194d5895a7782787d06a90544cfce1f382754840bae95e0abdff76e1c9bbe291cc17912d63ca900472ec0768c
SSDEEP 6:7+/l9ou/gPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKjols//1:7+tR4qLJdeWRmBEyPbjls1
TLSH
T1C802C0C863400803C86D5777A0CC83831F50A72A9F33CB5727910864BC076CCF890D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 11d12e25766b26f7d1fa3c2f2385eb29dd0ec4a47272fa307f424caa1ab939bb
MD5 85502edb5bd5ef130eb965f13cd70d3d
SHA1 9e41fff1c6be05110dbc44f881b1e0d8af8fa444
SHA512 71602f259bd979e29d840dcd2afaf7b867aae503448620353286efdf87d479d4db1e6f0f0d2b46e32919f22144154292c51ecb0bd20e4d29115467f21f3b6e91
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwhk/0RT/VM/QCql:TLROpmzr0GSNh/RT/aA
TLSH
T10C72558DEB20E307E1774736E8CAE3D23D74316A0333C6077A811B6C6D8224664A1F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 ce3bfdeff172864f05bbc95259a6dd92a4096fe007fd932af92b13b784b7b206
MD5 35a37f4467fa9b6d0edb3f107d5ea3cd
SHA1 763d3d0c14089f7c3b99e72fd6d30e18a74c89dd
SHA512 7a087a2b1ac22799869d23bfa2d892c734c00f27738aff0244d3797d865aa1d2ddcf34558dbf24592776ce76b98e3314c417679fbf79c04b6348c2d7777ca299
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/3p/0RT/VM/QCql:TL4pmzr0GSP/3SRT/aA
TLSH
T1427255CDBA209707E273437AA4CAE3D23C24316A0373C9473E401A2C6E82646A0A1F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 9378eed2a528ec191d2e40ae24b885d64a13c5c93662a03fcca84adf049653de
MD5 4faef41925782e329713e6a245172c7d
SHA1 445a6bae2c7a84bacbfaf5bf605635ad330f049a
SHA512 639142e4aef38f7121c9de969735cd81039830639cce158197b8e63c638d76789693f83f959c9ca7c58aa1a3059b8ec6949160e6edc64f91ba9ea1d88291cd25
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hZt1kn+/0Fl64/zN4p/0RT/VM/QCql:TLopmzr0GSP/hZtunlFNuSRT/aA
TLSH
T1DB72598DBB14D707F2774772A4DBD7E22C3431656723C6173E411B1C6D8228151A1F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 fef0a99df12b8cab75f8c1319254664d12f2143fdae58455826a792ed9b2f51b
MD5 2821a60ca74b1f324d03db9c69910670
SHA1 a7f5a81e12545d270d39848d38648a20685f117c
SHA512 d0ffc8eaf52a15a80650d98f93cd4c520fd5b33e67a8a1cd6495303997f2ea04a9cbf82695c25b20d3f29d49e9c99f3fa821f59edf0a07ea6b52ddf1d6eae6e5
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/QH49blqYFly//2n+/0Fl64/zN4p/0RT/VM/QCql:TLYpmzr0GSP/s499FE2nlFNuSRT/aA
TLSH
T1CA7244A9B728D707F2374B35A0DBE7E23C3431A62323C6127D421B1C2D8338282A1F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 7aa95575c0fb2f85b8b275ea186512ffe1b0355838bb0cabb2443c9d5e391b88
MD5 c90401f20a9bb7a8c2e412aef42a928f
SHA1 f0b96b4ef8be2d1c02348bd347780504563ae501
SHA512 be897be9a687336e3edecfbde601f7861163db1ec439e46de566e3501275e03c1d5389fdaf05639de466e5c25a4aa51b1674db6a30c5287a0d9c3e213f8e20b7
SSDEEP 24:TL6vpmzr0GSP/ogKabCCb25X499FE2nlFNuSRT/aA:T2vArSP/oFabCCb25I5bnwiJ
TLSH
T19F722699B6A8CB53F2774B39A1D6EBD2393431A61727D6137D421B1D2C833928161B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 056a7fa6fcb890d0ca33c251899d947b025c29dad0582f11236a01779381dd02
MD5 5540b9bc9a465a4e8eb93c7be82975bd
SHA1 fd5a525e5dc9c7634ae3d6b0646c6cee7aae02fb
SHA512 83f3eeb5fb1af3f798c36b8a667e4ed3978c4f6b24d68c47f219e0663b57e47d90e4d407205b3fd8ac3b23332082fc631b7ee43a5435f6544b51e8455d8c8130
SSDEEP 6:l9bNFlkals1FnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wf:TLCuEJ9zmzrfRmBEyPbP/Wf
TLSH
T18D72C28DAF102617D6730B7378C993916D15A22D8336AE4B2BD50460AD4254A9151F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download