f650d333d32fce85a906bded4fc57213c90052b08f9ace1c0cca5e658eeb7432

Analysis

max time kernel
179s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
27-07-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f650d333d32fce85a906bded4fc57213c90052b08f9ace1c0cca5e658eeb7432.apk
Size

2.9MB
MD5

eb252a58ad9b57f0a570ae558acc2944
SHA1

c29cff7b0613440d721bd2aeb28136df6360720a
SHA256

f650d333d32fce85a906bded4fc57213c90052b08f9ace1c0cca5e658eeb7432
SHA512

26fa710f68231309c43013d62266319bfca20590cbc76ea7b399cfc7208da6c53fb13d2a06134ebe907c094cc18b555c5a47d48c12184c587f1c6efec13e8c93
SSDEEP

49152:gSwIWI9ccWpr8U5qMxPZSpp/QtcnHJtLQAj7iXVDuWVcT+BFkcGZplDesZ8RygCf:FwInccW2xvpRQmHca7QbVTBFkVrp7RTb

Score

6^/10

evasion execution persistence

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

Processes:

com.pasinawuwi.print

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.pasinawuwi.print

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

com.pasinawuwi.print

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.pasinawuwi.print

com.pasinawuwi.print
1⤵
- Checks the application is allowed to request package installs through the package installer
- Schedules tasks to execute at a specified time
PID:4498

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pasinawuwi.print/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
4a1245bc592d59fcc088c10ea3e0cf62

SHA1
d7cb90109fcf11f2fa12d6293b98c29806334582

SHA256
18f8f9acc2dfe6e6ceddb52788884de65e8ceb1ea8b36857b8aff6080e7cc8a2

SHA512
80a9dfd954779208cafb1aa0cdd9ac9484df4d7df541d2e9d38d7fad440992a8e25b7a5272a86c9be2552a22822b58017a07ba926e7650e80bb990fbba55d65e

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb

Filesize
184KB

MD5
daeb85ebe7bbd976a2c4a1bf8cada77a

SHA1
2e33f031d985a4d8956f0a12f37cd25c415f2539

SHA256
2edd9b8f16271895853fb823dd03b142cf0c43cf06788de0b53defa5f3815689

SHA512
037d8dd902718a3de98f3b3c2bfc74fae0d7d99a97312517af5fe55a5533cddc630238bb7a8b3b509dc95eb83f5b77a409c7aa270ecbada0bd340d53a4f8a413

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
495b72c3d20fa66654eef8a4ad020089

SHA1
64ffb6233ba8b845667fa47016307a78222ecfd4

SHA256
a001f57e9b6514535fa314c648cbf27ba84fc7c94f224ce2847aaacc202f480f

SHA512
c50098c5603e610b00b115ae94a0fa2bb5d1e714cd9582d99ca9b9317d639e08c0576b36c2c6922ad547de901bcf061f3ed6aac7b5bae13971191964493e5cf8

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
546b126827de80544a50bfb5eb20015d

SHA1
814d2047d5cbac1ee0ff50cb3788f2ed4a47e778

SHA256
d4d1d09cd0e3b5cdd18f0388408608b19d8271a6d9b1efb5b9cca6263a7de92e

SHA512
f532721b2d0eff050c9832fda67ccf12ec5a1c777502dc3aeea18a7ed3ecc066c21c2ec75ec021e0bb2a7a844710a64775a163fec69840c319bfae03ed5f2de6

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
c7c7bef09214c4edcf218f338f3d5ccd

SHA1
8f86f02d27dabf8127a1c05811c5107875f1e7bd

SHA256
57f3e373e26732b2aeed0d6977363df3d33c0fb26c806f14099af5aba38b3235

SHA512
b3a9fa94f6860ae063601a59bf33e5604734e1a38a8953a18ce59f8389799202da8834bfe794508fdd183e31418de2b1f3bcfc78d6432781d6bf256ed1787f25

Download Submit
/data/data/com.pasinawuwi.print/no_backup/androidx.work.workdb-wal

Filesize
422KB

MD5
d97c9e6e44b48e64fbc0c2603869f003

SHA1
d9be93d89b1e7727f8dba6ba684bfb7819d5d2c4

SHA256
774d123e265b44303a500676fe5cc6b70a2a26bbab683f7041c9f20f190bbaae

SHA512
432e266cc54e813a1d803a78e1c47438ec8d2b8f4619609ceba280022196e777ed4d9d052c172e1febbde572d2496df3890e987d52566727182dba08dad7326f

Download Submit
/data/misc/profiles/cur/0/com.pasinawuwi.print/primary.prof

Filesize
1KB

MD5
a1f30e03e097b22079260c153cb18793

SHA1
342dd39780450d75aa8f36818523600cc0fbfb9d

SHA256
171566a793af907d14566b651d0364181226e9fd7d6b54f4105fef2fa19f86cb

SHA512
8786d047b7ba946b7cdb0ca78379c369726127b9197b21867f5e9fe133999ace6ae91c3e65c06e2a7b09a4a616c86f4592d3aa3db8552dd1da03234b45dc8924

Download Submit