Resubmissions

22/05/2026, 17:20

260522-vwc9aadx9v8

22/05/2026, 16:07

260522-tk35wsg14q8

Analysis

  • max time kernel
    46s
  • max time network
    150s
  • platform
    android-10_x64
  • resource
    android-x64-20260325-en
  • resource tags

    arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
  • submitted
    22/05/2026, 16:07

General

  • Target
    P Launcher v9.2 (Premium).apk
  • Size 43.7MB
  • Sample260522-tk35wsg14q
  • SHA256 3424cd8a4a13309efb1ef9aeb75ee4af1d672ea46ce80c976e3774d9a35d4433
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.or.launcher.oreo
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5151

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        journal.tmp

        • Path /data/data/com.or.launcher.oreo/cache/taboola_cache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        app_icons.db

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db
        • Size 20KB
        • SHA256 0518f5b9e215f7bde4cb1cda144ee5559a5237d15a340471053475c7dc4766ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db
        • Size 112KB
        • SHA256 94ba92bf6d02990231586b4ce2d9d177e27f607a8ad69caa8cf4b375bc638ddc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 512B
        • SHA256 91f2eca447459a8668ca8ecfe826916cc80e163741a7a8bd8e88b3003e8b5d42
        • MD5 SHA1 SHA512

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 8KB
        • SHA256 1b304df3a68a1acfe84af10bb73e992e902596f82707f3bd4ec2d00fbacab9b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 8KB
        • SHA256 bf4da14e66ccbf13f4a8d5041dbf3d5410ace7a312ba6d0b7663253374c29c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 16KB
        • SHA256 633bec7df972806f7d4b8c052a31a028c86c29f0aa9a8e8a3311cdcd09282c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 16KB
        • SHA256 5daa43a2c7626f81fc6ee58ea5564f5c48fb6620a0ce5386120a59c648892c57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_icons.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/app_icons.db-journal
        • Size 16KB
        • SHA256 2c90c692c6ff4dce95f6dfce9315b5c0b579a17b8646772c662431437c1d3f8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db
        • Size 60KB
        • SHA256 b63d126b1b7847f5506fdb5d000295fbf95b09b11da2cf19d6422d188e0b33f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 8KB
        • SHA256 20aa45e6fd335842f172f4f27d68ae30a4fd77eb4c21a9a3d3ce2b263d90bc7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 16KB
        • SHA256 8f86c5910757c2306fd7cdb6bcd1a21629c77bffe6fdd5ac3c86cb524ce801c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 32KB
        • SHA256 116627fcf081b9f692b93da27bc6bea222f3185b8b4ba026fc4506316a460401
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 512B
        • SHA256 1e26a71d28e1f9b1ec108d2fb8c6268a180ebd74e7559b07c6ecfc9fb264c755
        • MD5 SHA1 SHA512

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 8KB
        • SHA256 b7b6fe4f84cd7db304380163f1e02f64788eb1b2d3896a7cda9351f395823c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        launcher.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/launcher.db-journal
        • Size 8KB
        • SHA256 918e60db9885f0f8b9a4d9fc6e600e9155673d0bc32ac8830d632a2a5ef2b28f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sort_favorite.db

        • Path /data/data/com.or.launcher.oreo/databases/sort_favorite.db
        • Size 24KB
        • SHA256 f2bdc1c69178eff6172f7c8ac8f882279eb1b525ff583b48fe21f28ea491b8e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sort_favorite.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/sort_favorite.db-journal
        • Size 512B
        • SHA256 d0041db2050a63baa2cfe066010f5f66f4ef226324a50d5eef63400f0a3148b6
        • MD5 SHA1 SHA512

        sort_favorite.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/sort_favorite.db-journal
        • Size 8KB
        • SHA256 5888837f8f2ee126b97b7b9a633a43ea68aa2f76218745d5a99845ac8b6f81b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sort_favorite.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/sort_favorite.db-journal
        • Size 8KB
        • SHA256 222bc74d6e99121fcc9645e477c238403372c654553755dcf8c61ed209af3993
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 40KB
        • SHA256 f518b24f3f7349938911fac8c0a74dc5da5609611c144b3064a8acc8dae5ed65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 24KB
        • SHA256 446d1817753c9f9e50e149dd434b1d38ec6d46efb6f0f7dc7b8db94b042e14a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 32KB
        • SHA256 82ebf29916ece6e4c696df5e332694b0b262d338fb3581054191ee9250f31520
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 36KB
        • SHA256 5673b339b39b1c60061dc6922793cda8a13a3c93ec21228a3bfbe9f59bee5f40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db

        • Path /data/data/com.or.launcher.oreo/databases/ua.db
        • Size 36KB
        • SHA256 71e7fe1771e9bd97c54d0361a6ae3477dd797106223e8d3d9a70e01143f9140e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 512B
        • SHA256 5cc4635d7a81ac49a8482910d815d19bf869c59491bdf16dc1c5c662093e465e
        • MD5 SHA1 SHA512

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 8KB
        • SHA256 de2e5973fe9636add87cdb80fdba4041e2f668137203ad27ec8dd5533abd96e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 8KB
        • SHA256 17a598f9b874523ef22b4f9c0be3fcbd7a15c3b07a9817a610fa9ed6c1615b2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 12KB
        • SHA256 f46a1533b8322cfc927b530bada2cdb469b767fd7328344ac857a52050073567
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 16KB
        • SHA256 627f8d2ea5c50371b484ca19b1cf7f31a475709d9aefe0e763f0513305345c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ua.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/ua.db-journal
        • Size 16KB
        • SHA256 29cdeac9cc95978439de3a5fb0bea86de487f42a08b12f06e17bd2af78d47943
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db

        • Path /data/data/com.or.launcher.oreo/databases/widgetpreviews.db
        • Size 20KB
        • SHA256 72db6d7e3b63668f8b352944ab573f026cb68cc4025be7019cdb9a54ebdc0fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/widgetpreviews.db-journal
        • Size 512B
        • SHA256 752cf260d61aa918d084f38e4ab0ea81079ac4403cb54394f47c0cf7c60a363f
        • MD5 SHA1 SHA512

        widgetpreviews.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/widgetpreviews.db-journal
        • Size 8KB
        • SHA256 51a47a1fff5fb8c3ed91a68d559657c3a496aaec80a718d705c03cbb64be743f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        widgetpreviews.db-journal

        • Path /data/data/com.or.launcher.oreo/databases/widgetpreviews.db-journal
        • Size 8KB
        • SHA256 8d4daae30b580f77dbcbd0ff6b8e4d4ac6201a0ef89a6e95a2742c2b89c6716c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audience_network.dex

        • Path /data/data/com.or.launcher.oreo/files/audience_network.dex
        • Size 4.8MB
        • SHA256 07fef7ea41d84ccf44ef2e2a6de8d23e3d3dd5920c87979a1d501a9cb6272496
        • MD5 SHA1 SHA512 SSDEEP TLSH

        audience_network.dex.cur.prof

        • Path /data/data/com.or.launcher.oreo/files/oat/audience_network.dex.cur.prof
        • Size 590B
        • SHA256 9b340ebe8ca786327621c09998226481fe36866307b5734123b0a5f1cc40a530
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.or.launcher.oreo/files/profileInstalled
        • Size 24B
        • SHA256 2ee1cb19ca685ad4afb182b238910429c01012f288715d15a8ef2451bcdb29ee
        • MD5 SHA1 SHA512

        profileinstaller_profileWrittenFor_lastUpdateTime.dat

        • Path /data/data/com.or.launcher.oreo/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 e7a8aa6f683d50a2fa1c78dddd5243f7ce706d3619ac37b08511025de990236a
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 62adddedfa61b049895ec5cb6b83d005051f089ac4f70ccf1148075fbbb9611c
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 8bfb322e607d62b582ba5ad928198501a702db485fd62eeb64e7cd806636565a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.or.launcher.oreo/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 539ef1d37dea4ee8c1d0ce4e5c872116882a98c1ffd9fa566ab663c02e696abc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.or.launcher.oreo/primary.prof
        • Size 4KB
        • SHA256 b0021ecf6b6ea9421dc00ececa3e9cd1739956200cae4e745198c14c73e73a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof

        • Path /data/misc/profiles/cur/0/com.or.launcher.oreo/primary.prof
        • Size 13KB
        • SHA256 d61ec3a8d81a14ebdc0ed8804977dac36cf7691b08a6f59becee0f287f6ea036
        • MD5 SHA1 SHA512 SSDEEP TLSH