f650d333d32fce85a906bded4fc57213c90052b08f9ace1c0cca5e658eeb7432

Analysis

max time kernel
179s
max time network
137s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
27-07-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f650d333d32fce85a906bded4fc57213c90052b08f9ace1c0cca5e658eeb7432.apk
Size

2.9MB
MD5

eb252a58ad9b57f0a570ae558acc2944
SHA1

c29cff7b0613440d721bd2aeb28136df6360720a
SHA256

f650d333d32fce85a906bded4fc57213c90052b08f9ace1c0cca5e658eeb7432
SHA512

26fa710f68231309c43013d62266319bfca20590cbc76ea7b399cfc7208da6c53fb13d2a06134ebe907c094cc18b555c5a47d48c12184c587f1c6efec13e8c93
SSDEEP

49152:gSwIWI9ccWpr8U5qMxPZSpp/QtcnHJtLQAj7iXVDuWVcT+BFkcGZplDesZ8RygCf:FwInccW2xvpRQmHca7QbVTBFkVrp7RTb

Score

6^/10

evasion execution persistence

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

Processes:

com.pasinawuwi.print

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pasinawuwi.print

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

com.pasinawuwi.print

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pasinawuwi.print

com.pasinawuwi.print
1⤵
- Checks the application is allowed to request package installs through the package installer
- Schedules tasks to execute at a specified time
PID:4930

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pasinawuwi.print/files/profileInstalled

Filesize
24B

MD5
0382c50df21d68c725b206bca2640b2a

SHA1
2bc15b9d0629edf6e252fa5c5734e86733065775

SHA256
9a21623bfac7b19930b4d1c041c9b1fd6fe81669627dad7623d9aa1b3e64456d

SHA512
b4697b67c2fe87f5de672e872fe91ddef024614305e0e56b70b31e02ca68a07e0efae9c3558ade5004443548997a0c0c504b9cb6a37da482111536aff79128b0

Download Submit
/data/data/com.pasinawuwi.print/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
6133c6244bf03ab767f8201d8148b1ab

SHA1
3d809a66ca4e9a7a68190090ea0a76e3430c7dd0

SHA256
cd1feb3d24cc4decd638ba572214b0e4ac046ed872b941a6ccc1b52d140e640d

SHA512
f92ccaa81d9aca422346d4258868f73dd5d5e73cccce292c859bfd1c0dadb5640220a965d93a19721ec1a1d8609fed7c734bb6b7c927ba2e54dc75bd1cc9125f

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb

Filesize
164KB

MD5
37b3382e2c60eedf99251b51d0f7f6ce

SHA1
77bc02ab7da2e02d7d6d914bac6e76eb2e303510

SHA256
2e19ff4f4baa5d45b2d63e25892f8398f89be54f6cb9e96b5e8f614587db565a

SHA512
e8d18d561a1127ec8e28b85eb21061e9c5a20386b5da45d13c4ef1c4bffc9a2e4c5e0ee9ea2c5f04d0dd9c2d2449029080670c4c4889f29ba5c20b778fec6e3c

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5170f1fb74156d8aa284cca7d5b3e973

SHA1
8af7a4ee6216c5f2edffb89d88f13bcc692a998a

SHA256
06423a41f745ace51477dd147fd9037ed1aa2dee71cf20c93798b70fd537ceed

SHA512
6455904b58e2bec9c4322452eeba790805b412758c81ee065742a58843392d7b69f8f997f3c799149796fda2b799c145c4b157466eb2116107432d5f9d89fc63

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
e5568f55fbcb4bcace5152c0602f1872

SHA1
1e9ce6ebac463abd5bbbbd4b21b6f9ddfb5835eb

SHA256
d47da9214f6546f5aa9e25636ac4a0541a5e752825bf6d60a110060e0773d7f8

SHA512
f47539f9488f9ed413e63ff3b7cd41faf113ead3dec5408c773999c85c01c7e84445f6ee865c843a378e0eb771d0552b2dd482ef4953d09c338169522b51154a

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
7e5a96b328c6c0267e6f32cf1a7bee7c

SHA1
a055ff62fb68c94f9ebf3e27215a125f553d8e38

SHA256
3be3bc0b0a01527b37d7174bd99c211b891b0d37162e22ca62cea0b55d61d6bc

SHA512
5e470dda2de00a32136e29283dc054d447f335c81262c0c9d58d4db55f8b208d3175709635bc2074957772490105250b357f9c9f98ca6ca2a8e5f8d11f89c349

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-wal

Filesize
434KB

MD5
318e4a6d800fb00342e8a90526de876e

SHA1
3c56b8185a3e5c7a20bb0f8c9664cb9602d5a9e9

SHA256
6b04d58f5c3ba9e8fd178573f5af390b6a5215c8819dd0bb18abfdc8a0cd5dfc

SHA512
0b13495111c7261a4546891098c4ef7fe7906378d19573f87d5008ec1b398ad2431e69eae42fc0f4d242fefd9e2d9bf7311f8a2483a569f3734d626b38e53af9

Download Submit
/data/misc/profiles/cur/0/com.pasinawuwi.print/primary.prof

Filesize
2KB

MD5
d8c413edb9c1601edfdd7a1313d303fa

SHA1
ff99f2049d686b4f0bf3efb300193b18a606811e

SHA256
db8ae42627e06908677b386792e2608c1dc1e788c3388a0e11c2cb790b2dae08

SHA512
a8e3286d0abd27895bf650eb8244c78785ce4b6259965b64f7cbb2bb70cfd6105d3ac43796605f0a1fbf1727515a9a1eb204775121ad9d9f7cd0ef6409a5df70

Download Submit
/data/misc/profiles/cur/0/com.pasinawuwi.print/primary.prof

Filesize
3KB

MD5
7af65d64dd34316845fed71ae48f91cd

SHA1
cbf823ba1aca41a29499130cd284f0a2d6390be4

SHA256
997b6ebbfd362b0833aea777616c1a1f588978139c3dcca5603767dbb5af0572

SHA512
486a834089b565d236ddef3def02c163fe6fc6a74299e548a7c8af62ba1a8d77734e008e246146ada59b70ccc8034dd1b2c01397e065bf54f13f3239a4360a76

Download Submit
/data/misc/profiles/cur/0/com.pasinawuwi.print/primary.prof

Filesize
1KB

MD5
a1f30e03e097b22079260c153cb18793

SHA1
342dd39780450d75aa8f36818523600cc0fbfb9d

SHA256
171566a793af907d14566b651d0364181226e9fd7d6b54f4105fef2fa19f86cb

SHA512
8786d047b7ba946b7cdb0ca78379c369726127b9197b21867f5e9fe133999ace6ae91c3e65c06e2a7b09a4a616c86f4592d3aa3db8552dd1da03234b45dc8924

Download Submit