3f6dee91da3d1c09fff32094d256351983cd55fd6bc98175e1e4de0b212e285a

Resubmissions

23/07/2026, 16:01

260723-tf6p8azzfs6

07/11/2025, 03:15

251107-drywrazldr6

Analysis

max time kernel
46s
max time network
153s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
07/11/2025, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f6dee91da3d1c09fff32094d256351983cd55fd6bc98175e1e4de0b212e285a.apk
Size 4.4MB
Sample251107-drywrazldr
SHA256 3f6dee91da3d1c09fff32094d256351983cd55fd6bc98175e1e4de0b212e285a
MD5 9f5702ec3179b58b37ae1cb2fef75886
SHA1 1353a0ea04bbe7ee31b183e742f7823af9aac355
SHA512 7cbdcc5d4ce4249e641e20d395de12279a7c250c69b7f5af3a0fd3cd2ce0898147e1663892f1612228c47a17a6d1fbbba9a37492a529933104561d55cd7a5c0e
SSDEEP 98304:QmNgBwCXz2eSl9LqAvPJ0bDRQaGzz93FidjIO8ftRrAetf:5SwCXiXlV3JQRU9VysB
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

defense_evasion

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.protect.download

com.protect.download
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:5013

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/com.protect.download/files/profileInstalled
Size 24B
SHA256 2021d2cdd5da647afd2c67ffd272431577ae073204cdc3cb845e8ec75bb2c3d1
MD5 6024e971513e2c0358926b660859ce79
SHA1 963e1d6beb753136f0d295aaa0f19e927e25c6d4
SHA512 859abe06fbb421a57a9b8fc59fa08f2f46d530cc81cfb7228816f5bf0a748564f65a3d9e8ab0e4fd0cc80015f9014ba4e1d59decf52050ae05480f065eae0049
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.protect.download/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 96bea534043d98415d5a7a40630f003fb2a17d9984585672ff1bf16362c2926d
MD5 52d91778860b8b03e5e7fdc892e3412b
SHA1 fdd100226ad072831858bf222a618a32e5ce7d99
SHA512 dcdd89d3319cb0f136b16d97d23f4147e8d4055d8db38d57be582b0bbe340fe72e0c5ece7620d7b21e573debd1aa0de8d712fea6f20812a90a2b044c11a0f534
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.protect.download/primary.prof
Size 4KB
SHA256 427bcccd16acf7e76975f0ca23865d5c4303c806d41c5bde879cea1e87ff9a82
MD5 3e2cc9946a2a1a8b71c560f985362024
SHA1 efac70c4eb98cbbcd2af625dabee1612eb80dcce
SHA512 f6c3f206c87a2ca61f7ed3abf620705065c054fe0bd5c693d65665f4eda93bbaa54e00a33b6dfb50aeedfeb3cabb449c9c2fd3fae75b1cccedf12f48e605d7f8
SSDEEP 96:TYBS+RVjVoerLc6b2Oqkv5C3BRqVlMbbcJdhTDJiGzSAdqPLwZUTo:nUVxjrLc6b9qkv50CJd5Zh+LwuU
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.protect.download/primary.prof
Size 7KB
SHA256 0657083bf937c3934fb34f16f1d4db177de537f5e88c1c4106a6c4900e19ad9e
MD5 b7e9b9f8002db7f3507510ab8bf758e3
SHA1 ed8757e4a5c9d7177a35cfe530120580b75ecc0c
SHA512 1d417df9a20f673dfe3ee94154f4a750876be23644be84202f155d39eb7bcfa6aaa3524e4eb45930e1428a6690ba975f0fbe2fa4510739c78e8c5ff5c0ef2428
SSDEEP 192:nljUl9Tc+P/YhfpnJVNSAnPOTHgXrMcqDAA57:nlIMc/Y7JVNSAxXrMcqt9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads