a977e69afb3586cfea1302ac4d7dc491914c72639b578375fc142294c119dac0

Analysis

max time kernel
7s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
05/05/2026, 04:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a977e69afb3586cfea1302ac4d7dc491914c72639b578375fc142294c119dac0.apk
Size 4.4MB
Sample260505-fdaccacw2l
SHA256 a977e69afb3586cfea1302ac4d7dc491914c72639b578375fc142294c119dac0
MD5 b5ddab31a79f638ebf25986e3d29c6c2
SHA1 beac369e876ac416211e84f53cb8b7b65d82ff22
SHA512 cab2915e97e3e187da6812081bfcccfa3c6c6e7875c928cb9f7f86c4db7b28907bc963e2a4650cb79c61f0c0afaadf6c132c72bebb4425b0cf408ba3b98969fe
SSDEEP 98304:mZRrfKsHuWgpSnq0KDm7ng/Wb9dO8ftRrAw+g:82sOpgnQD+g/2T+g
TLSH
T18826E186F768DA2FC877743209AA5231564B4D128E87974779443F1C387B5E80F5EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.mtf.protect

com.mtf.protect
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:4751

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.mtf.protect/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 ab5b22a60bb097cd8b67b7602b3bfbc25249501622bbb2b4ae4e642687e33474
MD5 a9c32995f65259eaabaa854d542d5880
SHA1 e0cdd8d48553566876abf228a678f5313821e572
SHA512 d53c9f94c96800b895ac0f5fe1f3b5ea02b43b4428b08765e07e628c7224a1f729a1745da3a442ceb26d3ad9968461eec0f8420ea373d48d641bf890a0c1c34d
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.mtf.protect/primary.prof
Size 4KB
SHA256 ebf70be81741a0df35d027c7473305debcc71902d37447c42c3a48dc38e22129
MD5 24179160c60dfd1b7ef7adba84c4f99a
SHA1 07d4b76319bb4c14c831eb4f29ac313736d8d4e1
SHA512 9b5f4c06a96e6600c2fa447ab34f4c0f465c10d10672d996c732013adcd694fa1429fe658af26f3e4fe835e62260c260532595dea2313a96b43388efe9096c9b
SSDEEP 96:gawFvyuiWaHeZxnkTo88TvhExiCHrTUblt+U6caw0X/7dM:4FquiWPxG5IEk+Mlt+rO0X/7C
TLSH
T1D2A15C3DAD527F51A01978F1DCEC1DA2A398D9814A691C9C32D8E812431A3B62B5DCFE
MD5 SHA1 SHA512 SSDEEP TLSH