File name:

bombitup_release_4.5.0_23.Dec.apk

Full analysis: https://app.any.run/tasks/861306cd-36a4-48d4-909c-dad7668da949
Verdict: Malicious activity
Analysis date: May 02, 2025, 16:51:16
OS: Android 14
Indicators:
MIME: application/vnd.android.package-archive
File info: Android package (APK), with gradle app-metadata.properties
MD5:

10A157F02C3F11E5EBC895ECDDAB4D2F

SHA1:

2EB51111D2F6D803ADB19B84AAB436A627FE3FFD

SHA256:

340D6219434E99979FF87906E44621813A3E8A1B6A9C65C0C274CE615B678584

SSDEEP:

98304:2wtcr8HeNSdVlLRRKPF7KfYaT4IDHtUMHEVsQnjhSPDKBEAyMP5D+b2JRm5MmdRQ:8fOhwaHrWABWfAiX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes system commands or scripts

      • app_process64 (PID: 2277)

  • SUSPICIOUS

    • Retrieves installed applications on device

      • app_process64 (PID: 2277)

    • Establishing a connection

      • app_process64 (PID: 2277)

    • Accesses memory information

      • app_process64 (PID: 2277)

    • Accesses system-level resources

      • app_process64 (PID: 2277)

    • Retrieves the MCC and MNC of the SIM card operator

      • app_process64 (PID: 2277)

    • Detects presence of QEMU emulator

      • app_process64 (PID: 2277)

    • Collects data about the device's environment (JVM version)

      • app_process64 (PID: 2277)

    • Returns the name of the current network operator

      • app_process64 (PID: 2277)

    • Accesses external device storage files

      • app_process64 (PID: 2277)

    • Updates data in the storage of application settings (SharedPreferences)

      • app_process64 (PID: 2277)

    • Checks if ADB is enabled

      • app_process64 (PID: 2277)

    • Uses encryption API functions

      • app_process64 (PID: 2277)

    • Launches a new activity

      • app_process64 (PID: 2277)

    • Retrieves a list of running application processes

      • app_process64 (PID: 2277)

    • Connects to unusual port

      • app_process64 (PID: 2277)

  • INFO

    • Gets the display metrics associated with the device's screen

      • app_process64 (PID: 2277)

    • Gets file name without full path

      • app_process64 (PID: 2277)

    • Verifies whether the device is connected to the internet

      • app_process64 (PID: 2277)

    • Returns elapsed time since boot

      • app_process64 (PID: 2277)

    • Dynamically loads a class in Java

      • app_process64 (PID: 2277)

    • Dynamically inspects or modifies classes, methods, and fields at runtime

      • app_process64 (PID: 2277)

    • Detects device power status

      • app_process64 (PID: 2277)

    • Dynamically registers broadcast event listeners

      • app_process64 (PID: 2277)

    • Retrieves data from storage of application settings (SharedPreferences)

      • app_process64 (PID: 2277)

    • Stores data using SQLite database

      • app_process64 (PID: 2277)

    • Retrieves the value of a secure system setting

      • app_process64 (PID: 2277)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.apk | Android Package (62.8)
.jar | Java Archive (17.3)
.vym | VYM Mind Map (14.9)
.zip | ZIP compressed archive (4.7)

EXIF

ZIP

ZipRequiredVersion: -
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1981:01:01 01:01:02
ZipCRC: 0x05cd8676
ZipCompressedSize: 52
ZipUncompressedSize: 56
ZipFileName: META-INF/com/android/build/gradle/app-metadata.properties
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
204
Monitored processes
79
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start app_process64 app_process32 app_process32 no specs app_process64 no specs toolbox no specs app_process32 toybox no specs toolbox no specs toolbox no specs toybox no specs dmesgd no specs toybox no specs toybox no specs toybox no specs app_process64 no specs app_process64 no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toolbox no specs toybox no specs toybox no specs toybox no specs toybox no specs app_process64 no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toolbox no specs toybox no specs toybox no specs toybox no specs toybox no specs app_process64 no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs toolbox no specs app_process64 no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs toolbox no specs toybox no specs toybox no specs app_process64 no specs

Process information

PID
CMD
Path
Indicators
Parent process
2277com.romreviewer.bombitup /system/bin/app_process64
app_process64
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2358zygote /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2359webview_zygote /system/bin/app_process32—app_process32
User:
webview_zygote
Integrity Level:
UNKNOWN
Exit code:
0
2391com.romreviewer.bombitup /system/bin/app_process64—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
65280
2400getprop/system/bin/toolbox—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
0
2415zygote /system/bin/app_process32
app_process32
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
2450mount/system/bin/toybox—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
0
2471getprop/system/bin/toolbox—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
0
2473getprop/system/bin/toolbox—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
0
2485which su/system/bin/toybox—app_process64
User:
u0_a108
Integrity Level:
UNKNOWN
Exit code:
256
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
323
Text files
127
Unknown types
11

Dropped files

PID
Process
Filename
Type
2277app_process64/data/data/com.romreviewer.bombitup/files/PersistedInstallation2973134235013099494tmpbinary
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/shared_prefs/com.google.android.gms.measurement.prefs.xmlxml
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/files/PersistedInstallation.W0RFRkFVTFRd+MToyNTc0OTI4MTE5NTc6YW5kcm9pZDo0NTk2ZmNjZmQwOTc4OTNmZGVmZWZj.jsonbinary
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/shared_prefs/com.google.firebase.crashlytics.xmlxml
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/files/.com.google.firebase.crashlytics.files.v2:com.romreviewer.bombitup/com.crashlytics.settings.jsonbinary
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/files/.com.google.firebase.crashlytics.files.v2:com.romreviewer.bombitup/open-sessions/6814F8160131000108E5213D53C81918/reportbinary
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToyNTc0OTI4MTE5NTc6YW5kcm9pZDo0NTk2ZmNjZmQwOTc4OTNmZGVmZWZj.xmlxml
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/shared_prefs/FLURRY_SHARED_PREFERENCES.xmlxml
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/shared_prefs/com.google.firebase.messaging.xmlxml
MD5:—
SHA256:—
2277app_process64/data/data/com.romreviewer.bombitup/no_backup/.flurryNoBackup/installationNumcompressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
66
DNS requests
38
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
172.217.18.99:80
http://connectivitycheck.gstatic.com/generate_204
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
445
mdnsd
224.0.0.251:5353
—
—
—
unknown
—
—
216.239.35.12:123
time.android.com
—
—
whitelisted
—
—
172.217.18.99:80
connectivitycheck.gstatic.com
GOOGLE
US
whitelisted
—
—
142.250.186.164:443
www.google.com
GOOGLE
US
whitelisted
—
—
64.233.184.81:443
staging-remoteprovisioning.sandbox.googleapis.com
GOOGLE
US
whitelisted
579
app_process64
216.239.35.8:123
time.android.com
—
—
whitelisted
579
app_process64
216.239.35.0:123
time.android.com
—
—
whitelisted
2277
app_process64
216.58.206.67:443
firebase-settings.crashlytics.com
GOOGLE
US
whitelisted
2277
app_process64
142.250.186.74:443
firebaseinstallations.googleapis.com
GOOGLE
US
whitelisted
579
app_process64
216.239.35.4:123
time.android.com
—
—
whitelisted

DNS requests

Domain
IP
Reputation
connectivitycheck.gstatic.com
  • 172.217.18.99
whitelisted
www.google.com
  • 142.250.186.164
whitelisted
time.android.com
  • 216.239.35.12
  • 216.239.35.8
  • 216.239.35.0
  • 216.239.35.4
whitelisted
google.com
  • 142.250.186.46
whitelisted
staging-remoteprovisioning.sandbox.googleapis.com
  • 64.233.184.81
whitelisted
firebase-settings.crashlytics.com
  • 216.58.206.67
whitelisted
firebaseinstallations.googleapis.com
  • 142.250.186.74
  • 142.250.186.42
  • 172.217.18.10
  • 142.250.185.202
  • 142.250.185.106
  • 142.250.185.234
  • 142.250.185.138
  • 172.217.16.202
  • 216.58.206.42
  • 216.58.206.74
  • 142.250.186.138
  • 172.217.18.106
  • 142.250.186.106
  • 142.250.184.234
  • 142.250.184.202
  • 142.250.186.170
whitelisted
analytics.rayjump.com
  • 34.117.255.242
unknown
configure.rayjump.com
  • 18.245.86.74
  • 18.245.86.121
  • 18.245.86.97
  • 18.245.86.115
unknown
update.googleapis.com
  • 142.250.186.163
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Android Device Connectivity Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bombitup_release_4.5.0_23.Dec.apk