Analysis

  • max time kernel
    41s
  • max time network
    64s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240611.1-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240611.1-enlocale:en-usos:android-13-x64system
  • submitted
    16-06-2024 21:05

General

  • Target

    Advanced+Xperia+Z+Launcher+v2.0.4.apk

  • Size

    2.2MB

  • MD5

    6ea9af65a967759a8e5f224259ce50af

  • SHA1

    ac6159cf07753dee94c20451a567ef2384a312dc

  • SHA256

    06325b83aec99f4f5f0aace6b8b7333cf81f2a732c1c118f3d351fdcefbe9756

  • SHA512

    d7fe9e8c0390eb561ed673e414b65fa5d08538a93da0151291bd964567eb620f294239efff0803b0aaeb8be41600c14b6f8c389f829487084d195836a707a391

  • SSDEEP

    49152:NoItoyFXsvFtU9bbouoVUwfKa5fQoYymCsyVZ1WAx4Ns:FtxcraXouoVdia5o+3PVZ1gm

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ra3al.launcher
    1⤵
    • Makes use of the framework's foreground persistence service
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4243

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.ra3al.launcher/files/apptray.xml.gz.tmp

    Filesize

    610B

    MD5

    44014f4a05403aa8748b9f06a7d04db4

    SHA1

    ab17b9d4601e42da324706e41e9f967cf6394678

    SHA256

    298c21c0c65e455ef436feb157699cd340b3c2680dbe78fdb2b9eed98afe47f7

    SHA512

    1e2d2fff09fd365f8fa5841d9424b7af9cd996b77f93efae88f06c99bdaa60c9b58c701c6e51f143ea7cad221c1f6263bc368f98701379bd8f74b7782c5c8a7b

  • /data/user/0/com.ra3al.launcher/files/desktop.xml.gz.tmp

    Filesize

    122B

    MD5

    4697e8a67ccf9ab9de9d24a33b6ab3b5

    SHA1

    b879fdbc90d68348ece4d3c06bc814203b333020

    SHA256

    395e08f1a8b30b595e1e57841c99898adf3ff845cc1ce675fe733d6e69a24062

    SHA512

    a7b99b099e0066eb00dfd0ba06f02ac01071a9ac8512b1f46fe882f261fe4353b754c3bc694bfc81fe28be7ae6cfcde140ebfbc7847c776cad5c3f2797e2866d

  • /data/user/0/com.ra3al.launcher/files/gaClientId

    Filesize

    36B

    MD5

    755efe757997be521c8a4da710e5ae8a

    SHA1

    a10f5e9542a0ce9f466eea8da70a6a95cb2a51a6

    SHA256

    16f4b2e6d8fdcaf8a10a42bdeaad057b609619d7850eb8df411c1417e7133983

    SHA512

    24800099b7573f1ce101da4bd22498e39d821641f1122d4f6acb2e890f1416dbfe34440e6e11b5e9552a3e73db689d7bb8a38277cdafc2ef1df5ab137b0ad61c

  • /data/user/0/com.ra3al.launcher/files/stage.xml.gz.tmp

    Filesize

    242B

    MD5

    0e50a4dfdf1305f33a4436fcb50d9438

    SHA1

    69c89647b1ed83119e2091aa318d552d2b47bdac

    SHA256

    02bc89417d32ae8d95375aed5cdd67c594203398b9ba4c4255b0cfc2d18f92d3

    SHA512

    df719963f3b18bde2db261af05951785aae972a3389506e529544dc804fa38b9af74f11eb37f153811ac78d7294b4edf44464fac370cc21169fa616935324ed8

  • /data/user/0/com.ra3al.launcher/files/statistics.xml.gz.tmp

    Filesize

    614B

    MD5

    c2e1add1613396fa889f19d937cc62ba

    SHA1

    28b46c007c9c1599dc130ff543f9d240cb7f500e

    SHA256

    a6dbfbb6376019556785921ed0206d79d53872d6021998834d38cd8bb7246cda

    SHA512

    f288ccb8dc846f9f661ee235b85d19ec03fd5c0f5fa7a8d83803d5e98903f8b46a43e0db990d49f2c35c581553fe74da56f76f71d9b9de1d6d44f7ba5d25ae91