fd9df391ae0eebb6969c635d1e78a0ea5cf987cb27bd143e0ac58efda6af6c27

Resubmissions

18/08/2026, 12:35

260818-psmqnabk5x7

18/08/2026, 12:30

260818-ppvbbssdlb7

Analysis

user interaction
yes
max time kernel
17s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
18/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nivo.apk
Size 1.6MB
Sample260818-ppvbbssdlb
SHA256 fd9df391ae0eebb6969c635d1e78a0ea5cf987cb27bd143e0ac58efda6af6c27
MD5 41aee9893fbc14eb190f872b94965fe0
SHA1 62aff47661adceb0418d9c71b0d49f3980e01d79
SHA512 94ae1fb02e5ec75578b922e2c22e476f71d48df1cdc933b8a48ac556fa26f619b025cd468f07ac02024b7f551d286eb1c7805f56bc392bc0b35ce909d0f857a9
SSDEEP 49152:/d88d81asz6jIc5xmiMe8fpqd7JyAWPiTRoES+IS:/d88d8bz6jQe8QVyBKVP
TLSH
T1A8751255FBA5F52ECCFB03301E7A826922366CA69F034543B91473BC28B77E44B055EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4742	com.dcto.pwre
/system_ext/framework/androidx.window.sidecar.jar	4742	com.dcto.pwre
/data/user/0/com.dcto.pwre/[email protected]	4742	com.dcto.pwre

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.dcto.pwre

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.dcto.pwre

com.dcto.pwre
1⤵
- Loads dropped Dex/Jar
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
PID:4742

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.dcto.pwre/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 ba8366779156a80cb7642ea2b86d85d87cc4ecc69d145c33b6aae67e6825dda9
MD5 1dfe6da794c92c60df4f2550f39bc05c
SHA1 6e654c3360c1cd998491c636301f933dec66f091
SHA512 724b2e975741994fe3b4979bfb0a74f8faaa33ef02d0c188385a1380dab5156ffd72391c9df55b39e7edfeed4435580bcb5bdc675f8855f0aa5c9015bcd01aa2
MD5 SHA1 SHA512

Submit Download

[email protected]

Path /data/data/com.dcto.pwre/oat/x86_64/[email protected]
Size 412B
SHA256 404eea74d75fac8b678131d7c55fdf0a3e3f423772712eff41f8646d2611f4eb
MD5 feb72adb1a9ae68763480d1964907c5b
SHA1 f931b92aa3978a8a4a8bde14699c21359aa6f116
SHA512 ca41fff227e42876eadb19ebd3e915cafa4f62a34a8293c88a0af932b03cbbde0725f2fdafaccc4b3b326fb59648a1b5b80105372f7aa20411d5b2985fe67e10
TLSH
T137E0F1A26B798000CE766978634A2A123B9031D73C5455E349E713B579A6EF4BC01E4F
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.dcto.pwre/primary.prof
Size 4KB
SHA256 b69ad6d1dd5730954a38f9179085fc884e8ee91660a261bde58b54a6635e7ac3
MD5 e180cf55bb8163725d3663280e2dd04a
SHA1 aeb23563e6e4e7a8f850d412182c6d7944bc4d5d
SHA512 2b7c1c4aa4a552d1223d80d259923a23ce9dd0364b355042519efecbd1a1186228ae2c502763032246a40d1ab3e13cf36500995b9491e91382ea83a1dae85b6f
SSDEEP 96:YOint5fW10e5t49eqJpuWDe+ZPBeqvR4Mo6nsOIiB4LJ0kTeVQGOXPA:6n3NeUrgW6kBjJG0I3Jc4XI
TLSH
T108A18E1672AC3AD80C376DC9C43ECF7D4113BFB671E66B95604E9D22034247D9564B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path /data/user/0/com.dcto.pwre/[email protected]
Size 1.9MB
SHA256 c706d4478aac184d5cff3b34c58da3caebba9ee1f0da04534ee448b46530e393
MD5 91703940557a0952062d4ac1c30a2a91
SHA1 5a3160232b59f697614a0b571e2bcaa3c5ba0cf9
SHA512 2938b18f1b89a96e1c0ff603644c3cb3a8d0e9d15337d983db28e941d14f46f70629101adedcf8fd023ab5f01c6b875cb9a1d3d00cfd9e6ee49efe105478e483
SSDEEP 24576:2OI6kIMxVGH8pVF4gANpZie8JteOrSIiJCWGs1hgzFpKERvfThr:N4GH8pVF4NUe+Xk1hiKq
TLSH
T1D0955FF1F7014A51E4D9B2387CFECE01F62C6C8CD5CE3A01150966F1AA6A2F47AB5297
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads