dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde

Resubmissions

12/10/2026, 12:42

261012-pxdcsawvdv10

12/10/2026, 12:19

261012-phgrnavzct10

Analysis

max time kernel
899s
max time network
902s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
12/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bomber_v8_signed.apk_Binded.apk
Size 6.4MB
Sample261012-pxdcsawvdv
SHA256 dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde
MD5 680a1958889a2912c2c21883b69c5dcf
SHA1 a7b8d87c08236d99d4d6b3b829ec4673a47d4ca2
SHA512 149a35b2dcd1bfd82cf79a0c41e493da2bd28eb7f0964514bf6bc0b368511bb9ef1a0fd05a75218e2df34d1db63ba82157a0994379aa06463902420682e6903d
SSDEEP 196608:3btaeYyie32OCJEEWAU0WtrkaQTfC91qDv:3bSyieGOCJEDZhQTLb
TLSH
T1A666D056FB48A92BC4F343764D7A1223650B4C268753C7D7AD04727C28B7AD0CE9AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	cc.bomber
/system/xbin/su	cc.bomber

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4820	cc.bomber
/system_ext/framework/androidx.window.sidecar.jar	4820	cc.bomber

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cc.bomber

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	cc.bomber

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cc.bomber

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cc.bomber

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cc.bomber

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cc.bomber

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	cc.bomber

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cc.bomber

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cc.bomber

cc.bomber
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4820

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

primary.prof

Path /data/misc/profiles/cur/0/cc.bomber/primary.prof
Size 2KB
SHA256 fd24fdec96ae4a0f4c2362c1a8fc1f16f29bee9b352610e8b259203c20378925
MD5 0be384b044e954bfa2d7d5880f2b8b1a
SHA1 bebb39321846c134102cea00a7e743019ba7ffb8
SHA512 5b9dd7057bb440eaecf6fec86eb9195924b82e82f54a3926fb618b612c99c239fd2b7b1d968a5cf12391acd7509c920e0a5b6ec65e12888d69c9ac5c825e4f18
TLSH
T148518E62E757BDA04FE7A21827D63D3D6D104124BE924E4075D213DF6C883CC9B46382
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cc.bomber/primary.prof
Size 12KB
SHA256 f187012e1104d86271dac6bef7ab93627e1774d2e0a07043ee06396d086562b7
MD5 8835384b0bbb5c29c1bb1ab3bb2fc966
SHA1 79c0a62f16484e29047e413d0a4f2bfd92d1641c
SHA512 347629fb6bc200170f9cb5d08213c541fc03e024c046c8ac91d125fcd4ecb1d8c9cd8b3a3560f053f0310bfc6cc1e27188604004fb959bbabfa2d20ceb4f5595
SSDEEP 384:j2BWvupCzRm5sTOfLv+yOb9uPadTwhXYB6:jNWv5sTGLWyXPa2hoB6
TLSH
T10E42B06756AE2751CB0E9E4257F22A5D87C248AFD51C7672210C76498CFB24364B0BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events
Size 56KB
SHA256 c0171a8802c9f613bc1e1a2a9ac5a8775ffeeafa4febd91c3b7c4208a1533b32
MD5 ce7acf4385dbc2883dc775f02c2245a4
SHA1 cdc1575f26490773fd31dc431223c2a06b9c62a5
SHA512 2b7a401c4a7e2d1f06e89c0048c1eb3bb51a797a2511f087ab595144b9f40468797059f0af425bdc381ce4305a824fd9a3f8b3ad6df21c51e5cfdb94ffc32a6d
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSZKkFXfb7tFXfbY:WMEqzAiwIyNjaZK6b7jbY
TLSH
T12743845D5A3C3221CA6D683DD7E243A32A7C83CF977292213E949DE68CC206578354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 5cd3278aaf00c452246e576e26fcffee51f3ba9bd62d4482d0d3787a334ca194
MD5 f32275ababcabfc8d673c10326416895
SHA1 5f3261c1562b9f235b27825f2dd9f778d6e793bc
SHA512 d7ed90f397e9ab7bc89558985ecd19592393abd3276be27c11bed762e7865a999e14f53cba844ed28b3cabfd1fd96e9f0baa5e687b30d2a9ae324c89d72cf154
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 b2e54485d7513b3d80dce50d837fa33302d2bd04a517febf11ffbd1d63396602
MD5 99f408d2a9434188023fa03812b831a9
SHA1 8331374916266c28fee3f8e3369b192e26643cc5
SHA512 2ab1befc33100ea841dbb18dd916cb3d209345d581c02528322478632ea14f4168dcb59808ce674b1aaa7293f80f4d7013a63efd0a5a8acd92a65d69ab0e92ac
SSDEEP 48:7MTmqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSM:7mm9MEqzAiwIyNjaM
TLSH
T1ECB2655C5D3C2321C5BE683ED7E142539E3C93DF672391603EA48CEA8DC2469B0395AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 83b0e035381252039689b72433c058a48380ebd88781e8da7e613cfab01775ae
MD5 d380793b0dc36baac9562a934c16e73a
SHA1 e81c2dd21361f486d37f060e09799ced323126da
SHA512 fcb59b3960d5b4111951aedbab69989a31123b686807357922d9e0305884f295461065e042131694ebaf998e0d28484ea6dcc92dfa327af7bd7e525cf7c05dc9
SSDEEP 96:7f0kgA1NUfb2GwqYoYsYnGpvtMEqzAiwIyNja3:7dfiwqXqGNX3W
TLSH
T12272E98DA92C2231C1BD797EE3F155535E3C239FA723512439F88DA88EC606DB06706A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 fa66b10f7cf98cad4cab89674b71a9b1399070bad21b7fea0b716e0c380e35e0
MD5 a8a040dc737cbc08cee02eed529a2eaf
SHA1 df24df37e4448c8bb89621a470afd02abc73f3c9
SHA512 85e1bcd07fb59969a4b5d5aa10c5cf07616ac7aa8b6bcabeeacc7caf749832b08b71cb9294bc14e903575c657368888b56a09e7b65e056009f226cd8513bfb0b
SSDEEP 96:72bLNMEqzAiwIyNjaXdMEqzAiwIyNjaNc:72bL33Un3oc
TLSH
T1A092729D5D3C2211C6BE283ED3E243A35E3C53DF572391603EA48DEACDC2469B0255AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 127e0dde2098b3d00a60a9d0678f39a4d555aac194f805dcfa576957c10a6d14
MD5 dad3e7067cee648c1548120a45217fef
SHA1 22f4c3c3972ce51f012697c938e0c981ce4ad149
SHA512 c2299fe64a5fece77270389e2e5d653fdd3b98298eea8ad1ea64b88f7efa46b55e64c032919a03ef0d2f756a879a92624de43a0d1568726ea9943403dc3d1eb8
SSDEEP 6:7+/l9qHn1gWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKg9:7+thWqLiuWdYRmBEyPbb
TLSH
T13D02C0AC6F800813CC2E9677A1F4C3481E40FF28C1B1CB37569008943C078CCE4A0F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 146fed37ed6e6ef589bde2f9a084559e47505880694020eb7bf03c7af8602d60
MD5 9e0b79de986d51f7bf3fb27979c6a5e7
SHA1 ba2c6a9f56babefa5a84e787ef77813e067f67ce
SHA512 6bb73ce4e50b4a34661c780f3936f04d89b6fed7c6aaf81c16f0aadf85a354e02d39bdc85d840ae9462b30cd4b186733274e39c07a5f580205776abec78be043
SSDEEP 6:7+/l9i/GPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKmgs//qn:7+tsiqLJdeWRmBEyPb2sXqn
TLSH
T13502229A63800C03C42D27B7A0CE83501E10A7289223CB0B169108A53C06ECCA890D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 7a98ea8fee2691f007535bc6b7b95442a927c0eb31b8075ed0047ddc0867874f
MD5 d63f30de4a229e75c363328890f71797
SHA1 08b77d77d8d51dff00ad1ff9f5161ba0a1b7dc1c
SHA512 1f3b9e7e6ef5aebf4c34ff0d7f2377fe0cdcfcf2454bc140dcff4dbc755036fd0ee05ef6239a6fde19d2271b4826f40ce7a315578474c91a33321ab6a72735cc
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwhk/0RT/VM/QCY:TLROpmzr0GSNh/RT/a+
TLSH
T1B272558DEF21E307E1774736E8DAE3D23D78316A0323C6077A810B5C5D8234554A1F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 bfd6d53cb832702c70a218ffcd367cf92d1869fb8afdbfecec0c8c594807117e
MD5 4a2040be08ed02d99d0ca0633a6c4c5a
SHA1 038ce0bcede47ad1cc74846837f8fe6ad150276f
SHA512 ad19a791971ca678a111c92ba5782a346e7ab313d2e77fdd55b2b7bb4bbb6b8efb4cba911a70137c66f1eb3468856f53dd58f4ba59b3e023fc20660872372990
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/3p/0RT/VM/QCY:TL4pmzr0GSP/3SRT/a+
TLSH
T1037255CDBE219703E273437AA4CAD3D23C24316A0363CA473E400A2C5E8264590A1F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 d271d466201383f5abbe2ba0a40cd129974a658dabbb8bf5132959cdc464eb9a
MD5 7d9e3a0361f23c5b2116862e46250ea4
SHA1 e7716b5d00d59c94353c5a07987809c45b174cb7
SHA512 e997a78726a3366a3076606c5885fb3fb699969aa1a009d1abf7e72b655219556d37f0af34de33898a1db79c6746c7b3ba19d1e499e788e1269f22b2c9c61859
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hZt1kn+/0Fl66hWdp4p/0RT/VM/QCY:TLopmzr0GSP/hZtunlF1UdWSRT/a+
TLSH
T1BA72598DBB25D707E177473264DBD7D32C3831695723D6563E401B1D6D827815192F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 6213fdc034b5f613e4220a78f8783408438012628188ee82d5519409286404d3
MD5 7ab3c9bf6416b82e822b04415556b2e1
SHA1 29cbbe5b9f33988ef703075e0e9264b2f2d96b75
SHA512 48924caca83bc93a682019ed0be21ef839fdde35bf90fb5adf67f34c0dfec8c4c5b2da6c22a18ebc5a650ea88f69489d912fc8d20e5c1acd252ac1eda7072d72
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/QH49blqYFl8oX0n+/0Fl66hWdp4p/0RT/VM/QCY:TLYpmzr0GSP/s499FR0nlF1UdWSRT/a+
TLSH
T14672499ABB29D707F237473560D7E7D23C3431661723E65279411B1D2D8234281A1F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 2ff8c60bb2f3ebbed6a537419d91a4f3f60af176aa9215254a884fbe4dbd52e3
MD5 3e374e9f9b81dff88ed8f87f4dd6efc3
SHA1 cac9515ec412e87a0df2600988f1811158fb8ff0
SHA512 82a2dea8d77df5e7045a523fc68e27c96194ebc8adaf593f0d3de67eb3379284b77ef7321959369e809fbfee8c26f2b5ad1b8682db4313060d65e8a4b8b346b7
SSDEEP 24:TL6vpmzr0GSP/ogKabCCbEX499FR0nlF1UdWSRT/a+:T2vArSP/oFabCCbEI5R0n1UAin
TLSH
T1F8728989B669CB03F273473950D7EBC2383931AB1723E7437D421B1E2D4238141A1B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 d1fe0e080a60120399f0503203950328cccc0b6eb35442f2090f3901659af522
MD5 dc113271a5e6b71a9c38496c495653a8
SHA1 4c8eb309ec46301e66952d1f92e601101304ec96
SHA512 8cf98c24e7a937ad8e04bce6864fef08e0f71e6326c3c63321e19572550cb87baaa6dd14fb953b3c4e7a74bb3d4eab12dafa0bc3d8ee1c88054b04c2dbbbfaec
SSDEEP 6:l9bNFlaLOls1TnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WEr/:TL5ED9zmzrfRmBEyPbP/WEr
TLSH
T15E72C28D9F102607D77247B378C99361BC24622D8377AB572BE50570AE434899052F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download