a977e69afb3586cfea1302ac4d7dc491914c72639b578375fc142294c119dac0

Analysis

max time kernel
6s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a977e69afb3586cfea1302ac4d7dc491914c72639b578375fc142294c119dac0.apk
Size 4.4MB
Sample260708-e51syabw3r
SHA256 a977e69afb3586cfea1302ac4d7dc491914c72639b578375fc142294c119dac0
MD5 b5ddab31a79f638ebf25986e3d29c6c2
SHA1 beac369e876ac416211e84f53cb8b7b65d82ff22
SHA512 cab2915e97e3e187da6812081bfcccfa3c6c6e7875c928cb9f7f86c4db7b28907bc963e2a4650cb79c61f0c0afaadf6c132c72bebb4425b0cf408ba3b98969fe
SSDEEP 98304:mZRrfKsHuWgpSnq0KDm7ng/Wb9dO8ftRrAw+g:82sOpgnQD+g/2T+g
TLSH
T18826E186F768DA2FC877743209AA5231564B4D128E87974779443F1C387B5E80F5EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.mtf.protect

com.mtf.protect
1⤵
- Checks the application is allowed to request package installs through the package installer
PID:4839

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.mtf.protect/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 1e2694559bf28cabc551792694a187eb2ccfd028bd7b14e6577d183f93edb880
MD5 b90d7db2f9e0f8927ce550adfa2d4db1
SHA1 f9244c2621a0196a8fcd1ca52127f5d75461739a
SHA512 64908f9db344219468911ff08dedf03496d648e116b1ca0f1ef2c8dadf29c268dd1338060a5766613cee1154233a051026f64e4fa447df276bd0a813dff5854f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.mtf.protect/primary.prof
Size 4KB
SHA256 ebf70be81741a0df35d027c7473305debcc71902d37447c42c3a48dc38e22129
MD5 24179160c60dfd1b7ef7adba84c4f99a
SHA1 07d4b76319bb4c14c831eb4f29ac313736d8d4e1
SHA512 9b5f4c06a96e6600c2fa447ab34f4c0f465c10d10672d996c732013adcd694fa1429fe658af26f3e4fe835e62260c260532595dea2313a96b43388efe9096c9b
SSDEEP 96:gawFvyuiWaHeZxnkTo88TvhExiCHrTUblt+U6caw0X/7dM:4FquiWPxG5IEk+Mlt+rO0X/7C
TLSH
T1D2A15C3DAD527F51A01978F1DCEC1DA2A398D9814A691C9C32D8E812431A3B62B5DCFE
MD5 SHA1 SHA512 SSDEEP TLSH