Resubmissions

22/05/2026, 17:20

260522-vwc9aadx9v8

22/05/2026, 16:07

260522-tk35wsg14q8

Analysis

  • max time kernel
    46s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20260325-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
  • submitted
    22/05/2026, 16:07

General

  • Target
    P Launcher v9.2 (Premium).apk
  • Size 43.7MB
  • Sample260522-tk35wsg14q
  • SHA256 3424cd8a4a13309efb1ef9aeb75ee4af1d672ea46ce80c976e3774d9a35d4433
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.or.launcher.oreo
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4314
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.or.launcher.oreo/files/audience_network.dex --output-vdex-fd=117 --oat-fd=118 --oat-location=/data/user/0/com.or.launcher.oreo/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4396

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        journal.tmp

        • Path /data/data/com.or.launcher.oreo/cache/taboola_cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        app_icons.db

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db
        • Size 20KB
        • SHA256 a4f4f3c415db389227e9b909ca295a622ccdad5912ddb85f4084240f0397bf70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db
        • Size 116KB
        • SHA256 e13cd04615e2dfd82a988f3940d9d7f4eec55b2261848dda1615caf3233db8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 512B
        • SHA256 2b8bec927a334479172cf7e45cdcc2e94349052d82f74b2a3fb9672d1ac5ab9c
        • MD5 SHA1 SHA512

        app_icons.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-wal
        • Size 32KB
        • SHA256 f25a61c69a629d317dba859d310dd7be3e29a56ed34fbd4e4214e969c231c811
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-wal
        • Size 418KB
        • SHA256 2dcb5aaf3213cfb13497c7fb8a3249eef7c607c042c57d488787852a50bf02c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db
        • Size 56KB
        • SHA256 1fd81c864eb5bd5cf264359a276dbdf15f60c61393651522d79854df20bf7698
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 512B
        • SHA256 b577b1edc48dd6244d5f3c5d90575ffe69ffc00aa5293423d9d5deafd0213618
        • MD5 SHA1 SHA512

        launcher.db-shm

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        launcher.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-wal
        • Size 402KB
        • SHA256 bdf44e0cbd71322c1e369caa428b66a5ef2a4e074477578a88ce2c852a267e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sort_favorite.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/sort_favorite.db-journal
        • Size 512B
        • SHA256 5c8c1785526ea5454d9e25521edc5475fce912a37f05731280eb71eb5106c8ae
        • MD5 SHA1 SHA512

        sort_favorite.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/sort_favorite.db-wal
        • Size 36KB
        • SHA256 777e93825fe186080882599ca1c0208d7fdeec3861cae7a067c71dcb9f97ece4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 40KB
        • SHA256 03e7d9dcd2b7ea5066145c3a37485fc33feab17179295b1c1143b16485d70129
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 24KB
        • SHA256 9bf7abc4895930ca955d973935710279e66fc592bad72238f63f073043a91112
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 32KB
        • SHA256 747995cbb18555c38b3b9c08225951d1434e1c363ca51eefb88a6d96aa2995e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 36KB
        • SHA256 6f718f74b30a7ed0f75b821ab74baa6766bb96a99fe88532ed1b33c7cc4143dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 36KB
        • SHA256 9d97ea2eb1c48cf27c19eba975fc50db2d6b5b002b29cd730f4266276ecca85d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 512B
        • SHA256 7383f5b507654f78cca46febaced9f194d6bd4949f454b32f12807f3cb626941
        • MD5 SHA1 SHA512

        ua.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-wal
        • Size 60KB
        • SHA256 354ad5930743928baf677cada26b888f1eff2324abefa4faec428f9ef35452c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-wal
        • Size 12KB
        • SHA256 4261aad168c7955fb8ae36401e4b90a63050266381b1e755e6ff93b327810e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-wal
        • Size 12KB
        • SHA256 6e150e7cc43d09722129198c243272adfa245df611634d2feee056d889ea9d51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-wal
        • Size 4KB
        • SHA256 d1cc16b4aa3996f0d8031ab6d40ad63afbce35b36bcaba566088496aaa3f3aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-wal
        • Size 8KB
        • SHA256 372ff4204ae14b95a7c6598772dd04273650fd8c5fe82d9d24985868784f9252
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/widgetpreviews.db-journal
        • Size 512B
        • SHA256 3250a8342fb682a5db21599ce69fb661992c559c8a272d327f1c060a58b0c0f3
        • MD5 SHA1 SHA512

        widgetpreviews.db-wal

        • Path /data/data/com.or.launcher.oreo/databases/widgetpreviews.db-wal
        • Size 32KB
        • SHA256 6d5700d51f88dd135809f6469bcd0f25e8be7c3b3c721a0adc75ee9b74addc65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audience_network.dex

        • Path /data/data/com.or.launcher.oreo/files/audience_network.dex
        • Size 4.8MB
        • SHA256 07fef7ea41d84ccf44ef2e2a6de8d23e3d3dd5920c87979a1d501a9cb6272496
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audience_network.dex.cur.prof

        • Path /data/data/com.or.launcher.oreo/files/oat/audience_network.dex.cur.prof
        • Size 747B
        • SHA256 e4b72793275c74af509d80dd193fdddc957b737eb1ce5a02f4e8e23aa6421b53
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.or.launcher.oreo/files/profileInstalled
        • Size 24B
        • SHA256 0e48ff08117d47845d511c267e571da3a7322881608ac00aa63dfed95f793653
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.or.launcher.oreo/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 176e6fd1cf45d2b18244faba44cdae302c67246620910438fa59ff9a2b9a1eb6
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 b25f2b9c3240dc40a7d1c50afb1ce3421128139ced97d542f4428bef2d7bc4f6
        • MD5 SHA1 SHA512

        androidx.work.workdb-wal

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 864b8d4ade63d54c3f853776a8ac0a74a7f01fe88bc151badcfdd54f64b7b55a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 685d8e643923fe71cc932bda02b9c6a56a1e4de2fb3b8d12af28d59fb014d228
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.or.launcher.oreo/primary.prof
        • Size 4KB
        • SHA256 b0021ecf6b6ea9421dc00ececa3e9cd1739956200cae4e745198c14c73e73a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.or.launcher.oreo/primary.prof
        • Size 14KB
        • SHA256 5727662aa749ee5a63ec56a08d54dbf044a1f4ceb312921f5f289ef6c6fad045
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audience_network.dex

        • Path /data/user/0/com.or.launcher.oreo/files/audience_network.dex
        • Size 4.8MB
        • SHA256 e67f1ae9225ff68ff50281fc6b85cdda58f33ea30b208072dda49e0dd673bed8
        • MD5 SHA1 SHA512 SSDEEP TLSH