e448eb297733b7a194b27f47b502f2ae14d17b97e98b799925eb3dc0e15f937f

Analysis

max time kernel
26s
max time network
24s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
04/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InstallWithOptions_0.9.2-release.apk
Size 12.5MB
Sample260604-e647rahz5s
SHA256 e448eb297733b7a194b27f47b502f2ae14d17b97e98b799925eb3dc0e15f937f
MD5 16d74d8c01ce92636837e7e57b7f99c9
SHA1 66c214d07316b717e491b6ed694ea4dcaad1947f
SHA512 c95e226f6f84fe33dd88db50153c08411e3f5a441074a57758a255ea917cbcf756070a0538a599773055d810232b57bab233de70ce1238c743eb0176b34bfe10
SSDEEP 196608:deWQK/euK2keKnFKI+L6KLuN1/2VtbcQ/CNoDIWVfCsKCBSbryQJfT:dlQD72GKI+zL8PiMWVfRK+1w
TLSH
T15DD61289F768DA2EC87B103249AA5231165B5D23DE83C743A96C3B1C38776E40F5DBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4688	dev.zwander.installwithoptions
/system_ext/framework/androidx.window.sidecar.jar	4688	dev.zwander.installwithoptions
/apex/com.android.art/javalib/core-oj.jar	4688	dev.zwander.installwithoptions

dev.zwander.installwithoptions
1⤵
- Loads dropped Dex/Jar
PID:4688
- sh
  2⤵
  PID:4744
- - id
    3⤵
    PID:4763

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

core-oj.jar

Path /apex/com.android.art/javalib/core-oj.jar
Size 4.7MB
SHA256 4df590b764f65c16b51176ff394458d0b3a866ca75a4f912d6f76b7793043c1c
MD5 17bf082d9e9a6eb8b5d62d82f4af5476
SHA1 a401c7fbd8feea319dbcece5b4b3f6a254e71fb3
SHA512 f1a2673bf5c478176de0fceec8419434ab0606a14343c3b7fe1e2b181b0a2ff8f00c888ea1dcb8e711c4eb14aa1294919440adc63ce7735a67e93da21a0f7ae7
SSDEEP 49152:rCaT/d/A6u6uT79YDz6beFEFNg40GwckDgO/Zzz2+gCq6gVpNkypHde:eay6279o4eFrGwLetPe
TLSH
T1FB369E02DD978E77D0BC833BC8F70B65ABB2D59877030753000AA7746E87BD6AE92165
MD5 SHA1 SHA512 SSDEEP TLSH

Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/dev.zwander.installwithoptions/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 2178c51af8f16d9ecdaf47d7021436588dc4d35aee9b4a70d2cd5b2b8a1f8e3d
MD5 86ee8383ada8c2f22658db6e47a4b3c7
SHA1 57818efac4f1157f2034d3be3e912884ca4f534a
SHA512 b450aa25aa0048b9c636efdf31b1f2e5707c752221f804ca9a6d04b23a8dfff3445251902f105494324fa1ad6180bb41793afc3f064bfc3a64e9776f45750729
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/dev.zwander.installwithoptions/primary.prof
Size 12KB
SHA256 aabf65be168ecf07879282a9c27bf7e5ff13bb59dd35553533d378888fb4ef42
MD5 9f5e3a94d134f7ebaeb4985d86481328
SHA1 5d5311fe4d6031e5186554382a02171fb132551f
SHA512 009f7987aa1b3a5c2ac2a73971c5d3573584c472c012ecb572d4987312c48185b51fef6dbba47f8a8aa777e1fd61f334c03c7207e9c830c73a332831def79b87
SSDEEP 192:5Wnx0QcVLw5Ud61YDsVlDUL17ZGNjZBSNHiPqDzt+gVG9I0qiWSV6:5WnWQcJEUs1YDsVlGANjON7bT0q86
TLSH
T12A42D15D47FBF7450BC9F36C4685E76E89E1650897F40B836F96C3243C5BB0254E5504
MD5 SHA1 SHA512 SSDEEP TLSH