c7af361711e337d7743cec3d91e49288ad5dd6d77664c1a820113db1ea89b01b

Analysis

max time kernel
8s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
12/06/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7af361711e337d7743cec3d91e49288ad5dd6d77664c1a820113db1ea89b01b.apk
Size 744KB
Sample240612-txvpaa1fqa
SHA256 c7af361711e337d7743cec3d91e49288ad5dd6d77664c1a820113db1ea89b01b
MD5 e7b9628a32b4f37f136ad77c5347e682
SHA1 cd789001a2d38d16a126660b80526d8d904a135b
SHA512 a1a2b1199dc9fd3fd5e0d5df83bf897b387d49be09977c8dc34816a72ad0c7122fab334c2c86e61bc813d58c941c65737a743db72b3a06407a190b90f2779559
SSDEEP 12288:zWamamlJCpDv6OhiGlhjEjdUp9ohTUtpgl7Q5lViKxVEh:zWamaEJCd6OhiK1EjvTepsUbVhwh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.ku.installer

com.ku.installer
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:4426

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.ku.installer/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 de8fe83853969298b4d1e80e937daaa60699b44e03c41f0f463e19d2b29a59c6
MD5 ee7da2951eda3c52605ada14d24aa0cc
SHA1 66c6eab258764d33601ad0c9de16f658c59ea755
SHA512 b301f952d9faa23920095affc5b7df2d6e9af50fa7b477ec722239c546429e7e54ab2246b9a8a2eab617b132373d94b4d5b1a0053620c4d4524fb5a8d3ea57fe
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.ku.installer/primary.prof
Size 471B
SHA256 8ff0c039db87d859e1d77bd940174ea8d273e0ee80381e0309690e796232279a
MD5 7164d2489e58288a138a54b90c2fd796
SHA1 83649263032a2f4c2111a92b5f1564060ebb973a
SHA512 c9cca8564e1e73d710e466ac3b74d1969bc49a994ffd17a9ac18cbf1c404306cac7314031a5f02d9e1c86c09f6b18a956b144d33dce54d8e3f5661c491589c5a
MD5 SHA1 SHA512