Overview

overview

8

Static

static

7

18b36e2d53...e6.apk

android-9-x86

8

Analysis

  • max time kernel
    3073901s
  • max time network
    152s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    26-11-2022 13:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18b36e2d53d73ba2f53be1acdbe76abe10cc4baf92745d49f3919a77feabf8e6.apk

  • Size

    1.1MB

  • MD5

    8b331632619cc78c77fc3676cb1a7b8f

  • SHA1

    1268aa4ca27b3e4c281937f0a1eebff3f12bbead

  • SHA256

    18b36e2d53d73ba2f53be1acdbe76abe10cc4baf92745d49f3919a77feabf8e6

  • SHA512

    d697d1a826b51e9679b1514866ad7b7070f4cb976e2d0f8e23f6932f508850f4441604ee21ec9b49ed947cdbbee8e0d32cbbc440d829ce163755663276b68ebb

  • SSDEEP

    24576:8NyXOY92RKt2Z3mkbaAfC8U01zIyhyYgI3hiUJNdB4P2:8NyV2RhjeTQzIywYlh/5V

Score
8/10
ransomware

Malware Config

Signatures

  • Requests cell location 1 IoCs

    Uses Android APIs to to get current cell location.

  • Acquires the wake lock. 1 IoCs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.ganny.rosebattery
    1⤵
    • Requests cell location
    • Acquires the wake lock.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4073

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.ganny.rosebattery/databases/access.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit
  • /data/user/0/com.ganny.rosebattery/databases/access.db-journal
    Filesize

    524B

    MD5

    c6e15287ccdd657a3cfc12987de3951d

    SHA1

    7cc9f73e4bb5193b79b75c9b5751394c69d8b208

    SHA256

    d02ee3fbb775d39e3d2a859161e57bc108bffd7bba77557c58317750173e7a9e

    SHA512

    3a443eb7adfea21a3d2e613c71b978a877d631fc4970fe916cd8c564a93a2d0bfcf10915294dc3d6cf7e00b82d9bf35097e306a2ea6586c14dd93a8bc403b993

    Download Submit
  • /data/user/0/com.ganny.rosebattery/databases/access.db-shm
    Filesize

    8B

    MD5

    7dea362b3fac8e00956a4952a3d4f474

    SHA1

    05fe405753166f125559e7c9ac558654f107c7e9

    SHA256

    af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

    SHA512

    1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

    Download Submit
  • /data/user/0/com.ganny.rosebattery/databases/access.db-wal
    Filesize

    32KB

    MD5

    6a1d2caee991732b9531dae75a9c573f

    SHA1

    c9b379ed1f3024220ae2e7ecac39228187de0490

    SHA256

    b2e51182cec22ee6245494eda36a24b5a6f70f7fdadd655133f4c164ae4e90dc

    SHA512

    ecd01f0b683bcd423749d8dc97d0d49ff3f9a1b266ccaa44847a77c9093f1f9bdc70662a3f471db2567be4d08a94eefb13ba8732857b821b5aa6928c3175ff7b

    Download Submit