c008519c81e8e4c166ac0cd70597b95409f004d3168eb17394a4fb210958552d

General

Target
Niagara_Launcher_v1.16.26-release_RBMods.apk
Size 19.6MB
Sample260831-b5ad7stbka
SHA256 c008519c81e8e4c166ac0cd70597b95409f004d3168eb17394a4fb210958552d
MD5 8f94e8a0883c4deea9325d3af7ecd0cf
SHA1 8b31b4242f8d25e4fd46f65fd0b535fef70ab295
SHA512 fc648f324cab8f38dcfa4ff663ced95c64bd9cbc587ad6f20f7ceb4648286aee6a9082479d6341caf4723a81dc53a7b836889193f82d7688e57a810dea35a7ea
SSDEEP 393216:rzGfxeum8ZWwsjMzwaxipcI+RmmeDh1mt1/E4mWwzZxhR6ntjNAqZrJJsZKHFR:nGENYsjMtiyPeDfmtJE4mWwHujNlZrJL
TLSH
T1F727029EFBE9253DC07A133AA94A023166994D24CF87D663B90C3B1D18B34D48F897DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Niagara_Launcher_v1.16.26-release_RBMods.apk
- Size 19.6MB
- SHA256 c008519c81e8e4c166ac0cd70597b95409f004d3168eb17394a4fb210958552d
- MD5 8f94e8a0883c4deea9325d3af7ecd0cf
- SHA1 8b31b4242f8d25e4fd46f65fd0b535fef70ab295
- SHA512 fc648f324cab8f38dcfa4ff663ced95c64bd9cbc587ad6f20f7ceb4648286aee6a9082479d6341caf4723a81dc53a7b836889193f82d7688e57a810dea35a7ea
- SSDEEP 393216:rzGfxeum8ZWwsjMzwaxipcI+RmmeDh1mt1/E4mWwzZxhR6ntjNAqZrJJsZKHFR:nGENYsjMtiyPeDfmtJE4mWwHujNlZrJL
- TLSH
  T1F727029EFBE9253DC07A133AA94A023166994D24CF87D663B90C3B1D18B34D48F897DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery evasion execution persistence ransomware
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Declares services with permission to bind to the system
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
- Changes the wallpaper (common with ransomware activity)
  ransomware
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1
- Target
  choot.apk
- Size 13.7MB
- SHA256 d76202cb837df92c4c5f4951e2e470cca5e032e22b47fbaf47462f0c256c88ca
- MD5 cdab564740e4f2de1b1d54627aba27bb
- SHA1 abc722d82cff463721ec9e16b9f4f11ee578469c
- SHA512 7e7706d01a9f1fb565bcc596d86042b911a426a1a76bc93463a8bafdc7a1fd741df18ab6f2304abb5cf8c625acd4f1a1e152522de53b015edd8d6f3f7f067bf3
- SSDEEP 393216:YzGfxeum8ZWwsjMzwaxipcI+RmmeDh1mt1/E4mWwzZx+:gGENYsjMtiyPeDfmtJE4mWwS
- TLSH
  T1DCE6F19EF7D9253DC07D023AA94A0236669A4D24CF87D663B90C3B1D28F34D48F897D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery evasion execution persistence
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral2