a6a184dfb4591547818c5ae3a0975b36267b8c4e1e0d3cfb1aefb655da316e09

Analysis

max time kernel
48s
max time network
133s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
01-11-2024 17:06

Target

e530813391ea660ddc3b94495b060a5b8d73368aff5ad8a3ab3f645234c764e5.apk
Size

17.9MB
MD5

c878f89fc345d39a5b599c167ce23fa5
SHA1

eb323deaa19469557b81bf99cf1aeb13c268c1d8
SHA256

e530813391ea660ddc3b94495b060a5b8d73368aff5ad8a3ab3f645234c764e5
SHA512

a53b13d285d7c5962a45afc929228c2ce94de344a50def687285341b6fbf3f67dd445544e4e9cee8d4bc60998c0d0cb86d981c80fa5c69af2f01cff24c8e93d4
SSDEEP

196608:DS69BN8O5zZcRGGBEbcjxrlzDV6Ml7asRyOdtkXGXXwcKJmUMGlOrINAHKdMabDr:DL0OGBEbc1Has0OdtcugchNXrINndjX

Score

6^/10

evasion

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
evasion

Code Signing Policy Modification
T1632.001

Processes:

com.support.litework

description ioc process

Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls com.support.litework

description	ioc	process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.support.litework

com.support.litework
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:4476

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

Code Signing Policy Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact