f64e3527dd7a9fe72687fdb7b191ac55e21404a10a7823adf88558756f6261c8

Analysis

max time kernel
176s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
03/06/2024, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher3.apk
Size 4.0MB
Sample240603-lcq7csaa4y
SHA256 89989a05630ecc7bd7be28ed77f9cbfd1c74a5612aa7c4470bf1e977132afb80
MD5 9e164feeb01f6420fec87e069e42326a
SHA1 ccddcfc2ff287855bee059c0a591f4ce6bb6a4b0
SHA512 6bf5021114a47fc59e89dfcb19b5c07a2e195c90962a2d8a30891d7369251cc25dedfb13b0dbe1b480e6f649620fdad91cb956357330ada59d1e771adcc1015c
SSDEEP 98304:e9azSX1djQ2vZdvZirT2JNqGqe8ewMbBpiX4IOJLk:e7f7xVW2JUG9KMqX4IOG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion persistence ransomware

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.baoruan.launcher2

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.baoruan.launcher2

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.baoruan.launcher2

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.baoruan.launcher2

Reads the content of the call log. 1 TTPs 1 IoCs

collection

Call Log

T1636.002

description	ioc	Process
URI accessed for read	content://call_log/calls	com.baoruan.launcher2

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.baoruan.launcher2

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	com.baoruan.launcher2

com.baoruan.launcher2
1⤵
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Reads the content of the call log.
- Checks if the internet connection is available
- Changes the wallpaper (common with ransomware activity)
PID:4637

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

Call Log

T1636.002

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 164KB
SHA256 650ea9942baed212c76ec431459c77997f8320de02b5ee88d792531f5c2cc367
MD5 a18f290190de9484ff722117f2c73981
SHA1 fd601d7ff6c4902b8bff8b2fdd11ade0082ca6ba
SHA512 5b66927104d92490e075ac4596e5dfbbf9f93a037101fadf39c71839396322323ef52164ac926bb78ea7eeb7a7ea914cae8007a9f9ded059db39888e5b3ad21d
SSDEEP 3072:PliHgfaFUUedm9uPSmMhgJ4eTZ15T/yUoBwUjjFzb3Hu82CHSltM:kW9NP8cTZ3/awgzbO1tM
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher2.db

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db
Size 60KB
SHA256 8378b5a61049e8c2d0fecd275b9ab49cdaf20b6d5f07003c5bf807fa4f8ad033
MD5 a6a317184e168ccf00f8a5dd5af40c51
SHA1 5c5d7fa23a9ada72d9b91e058925a5517ec8b6d1
SHA512 194ae5a5c2d6d89ed43cfb5fe4d80f66badf8554582378e050c7573b165a9d456c58e5bef6d0e500bf1d4ebff266dbc613f0b8c9ceafe3f5e150c2eb66d67ec6
SSDEEP 384:AYnVzEHyli2lATo5jCkxU1AVphMM4rhFCfm+Le:9VtlsmG1mphMM4rhF+hq
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher2.db-journal

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db-journal
Size 12KB
SHA256 da3e93a417e6c6342cba67dc634c9a465cde5fe107129188c63c01aa5c6577a5
MD5 047fc69c5c82d1a3776c8db1449cfb7e
SHA1 237a388eff7da6c56a24969c42efd0af0c6e7f85
SHA512 1c2471e233a288910b926c0a6d78619db0e14b9bc17669b8e6131b0fc9460efc72da1959d6c2e907bd836e29933112f3a42798f1a254ca62f58eb1f19b49815c
SSDEEP 48:7MJgB8A62D8WF8deS8JkyJ/8OotwNGK8OcXMXNGGD8RED8OSXlt8Ogd82qCL0Otg:7Jfm8SyGFUGGLUsJLHV/Vc/H1xC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher2.db-journal

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db-journal
Size 512B
SHA256 f1c4760f673d8b2452106dce59bebf078365129f3c0814950b896cef0fa842a3
MD5 9fe8ab600fb118cc06fa5fefa817de96
SHA1 44d43ccbdfdebd01acfabbc43d7b1ad3befdb5c5
SHA512 e1e61d0e68e445599763bbebc87b0d1f61efe59d05ee1c0db391d986a90a169a240d818bb0fb6f0b64291f21e9978a41d9742b1f14bb3ae53e13eaa3dc38d4e2
MD5 SHA1 SHA512

Submit Download

launcher2.db-journal

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db-journal
Size 8KB
SHA256 2b47ea1c2efc8f9d316c98b7ec33e58af97884441f1834f36bc90ed1480bb9c6
MD5 3d47885d3fdc2ce9e3cb4cb7f57e4749
SHA1 eab284a7a85973596ce4f16702a23331dcde8509
SHA512 7b8fbf483cff3ce2234b7ce96ed9e37be045abf402678bfdcda55e5b5efc188827453177168a4307d65b15f3c642cdc9d375f4f2c4b3af70cac4f17efac74f16
SSDEEP 6:7+/l9an1lg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKyj:7+tgqLiuWdYRmBEyPbRj
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher2.db-journal

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db-journal
Size 8KB
SHA256 2160c48538db975dece919fe082c4f654a99ea0af8e2d81fc446135aacefdb87
MD5 c1f8517184dd905168b82655229fa56d
SHA1 47d6d7f4710d08807e4b74bac523c7570a1a83b1
SHA512 19d8aae81969f0c1bcb1e9311f391d64638b09a94779865fd380e17396563cf13edece68783bab5567b7639473c2d320a385e2c65ea49fe288a63db713355129
SSDEEP 6:7+/l9a8HPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK7C/1I:7+t3qLJdeWRmBEyPb0S1I
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher2.db-journal

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db-journal
Size 8KB
SHA256 f804999a1e2e4bd6b149c05625f7a3c8c168e747da10be6e6a5ab93555f807f6
MD5 332fb7cb2c9efc03e9bd26933a3931d8
SHA1 c45ed96ce6270758e98bfbd66682e48949fe635a
SHA512 73b7eed49f5946dc59110b3bea6e70ffe2a93b1f93bdf211fa3c67d36f02fae394f11f2d5174a420d62cde2f4e9b3625c55d5d6bade0454fb6b651b1fb00e268
SSDEEP 48:7MPqZ80OtVBB3lqV2rJtcBBjVj5FW7qV9t8EJdqVASk:7iy8HV/Vc/H1xCk
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher2.db-journal

Path /data/user/0/com.baoruan.launcher2/databases/launcher2.db-journal
Size 8KB
SHA256 e908d08cc51f5bbbfe18e6126a17ceaed4202cc797a688db3dd808e8d38b2c19
MD5 8a5c2eeb55e4800e2e3c57571f272c78
SHA1 0292688b7cce2af3bd569da6737db46248060b79
SHA512 b1823fd8db9ad636ca98372b8bd678295f4c22af09df85509ebc7cd856973bc50104da2abb7d961defef0b4a48fac470c022f104fd2c71a8cb4189cf1e57f5dc
SSDEEP 48:7MDVMqO90OtVBB3lqV2rJtcBBjVj5FW7qV9t8EJdqVASR:7+KF9HV/Vc/H1xCR
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher.preferences

Path /data/user/0/com.baoruan.launcher2/files/launcher.preferences
Size 15B
SHA256 9bd54ce2fe34faa03d173df22621b5c747e544ed354e521889b692c031ba99b3
MD5 8045cecd3d5a4c893e3a75d47b17121e
SHA1 61f08d6c53ae857cfd4be1bf607a6c80e5e78b23
SHA512 70d34c24ccb3f90cdf930f0e24d67441e2aafc5baa5ae95c5e288b788cf25df394254f9bf55d45a5893b78457873b6169b8868a4fd45364c2b485f90bd4c0099
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads