e9f2f6e47e071ed2a0df5c75e787b2512ba8a601e55c91ab49ea837fd7a0fc85

Resubmissions

13/06/2025, 13:37

250613-qw645sam9t10

09/06/2025, 08:27

250609-kclq7sbp4t7

01/11/2024, 07:56

241101-js2xpaxjbw7

30/10/2024, 09:11

241030-k5n22aypbs7

Analysis

max time kernel
42s
max time network
1790s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
01/11/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
certificado.apk
Size 17.9MB
Sample241101-js2xpaxjbw
SHA256 e9f2f6e47e071ed2a0df5c75e787b2512ba8a601e55c91ab49ea837fd7a0fc85
MD5 3701535f51fe33673fef155d43247df5
SHA1 e0eb39589a97a4d576b8f9be9d41cdbfbd177c67
SHA512 53e4ef2f7ebf41d3367bf556ba03e32512d4fbeb1aee3c5daa462daf9671fff948b1bcb1a3c531932f79c1cf088eb5bbaaf1d43ed2dee55388d53e30c394eb34
SSDEEP 196608:DS69BN8O5zZcRGGBEbcjxrlzilUasQyOdtkXGXXwcKJmUMGlOrINAHKdMabDu9I:DL0OGBEbc1RasZOdtcugchNXrINnd1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

evasion

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.support.litework

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 21 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

com.support.litework
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:4994

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/com.support.litework/files/profileInstalled
Size 24B
SHA256 842abb19138305c2a75364561adfd5b6bd9109f0b9798171a8599d642cf2ef36
MD5 7d180746471024e8ea40adf02147bdfe
SHA1 a95d16a1b933e6ddaac112309f7824bdae7bc48e
SHA512 af797dafeefd1b9a24eacd8539503ca1d2f14b2b8a73f96fd1d9b76951f79d1088462a8e007c556bda5e72be6e56112b3ca34983d9266ff10dffa258050db469
MD5 SHA1 SHA512

Submit Download

update.apk

Path /data/data/com.support.litework/files/update.apk
Size 8.1MB
SHA256 73e647287408b2d40f53791b8a387a2f7eb6b1bba1926276e032bf2833354cc4
MD5 6841b9fe23cde512d040a8eb2a76078e
SHA1 80dd5ed2d4996b409c957ce363831041783f5506
SHA512 5874ac297770861e4ebe673c68ff1da0fd6c4331b2e6365b90e5c0a8920abd97469bc9b59ad87b5afe65305451d7b42e208b351fbd5a5499de7d625191ec013e
SSDEEP 196608:k5DSkcg1MKk+TwUREMVpy9oQl2FsJe9UacZZoV4:kUg1MlAvEOyyQlxJtZZh
MD5 SHA1 SHA512 SSDEEP