f01f5cf89038ab58b8644c4f9711d957918da1cd5751f448ef7f66a029c2ec15

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
46s
max time network
67s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
29/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Etbdd51_net.mobile.android.update.etbdd51.apk
Size 4.9MB
Sample260929-pr4yjszfpf
SHA256 f01f5cf89038ab58b8644c4f9711d957918da1cd5751f448ef7f66a029c2ec15
MD5 fc04496d42a9f5da8b5f1be40e79219f
SHA1 58cb8e383fe4a5b9f1a0a6bcf3d47d6cb54b8d04
SHA512 882dbdd1da1965cb33c9699c6303c135a8d6f4232a533c2f18bd85a7f407e35f5ba1946919b6550bb8d93c1b63012175684e6626b7f9a11f7a09ec8d3f74e491
SSDEEP 98304:+Kbf1/Q4/YoM3Ex/d2+5rO7Cof91pBDRE/9T1FDjrzcfc+3SgQgKPmqHRxj+Fba:+Kr1/dYoM3oYN9bDRE/9xF/cJPuR0a
TLSH
T11F36125BB784492ED8BA81324E6E433026635D429D939B4B7544321D2DB3B8C4FDEBEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	net.mobile.android.update.etbdd51

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
20	api.ipify.org
22	api.ipify.org

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	net.mobile.android.update.etbdd51

Checks the presence of a debugger
defense_evasion

net.mobile.android.update.etbdd51
1⤵
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
PID:3302

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

base.3302.tmp

Path /data/data/net.mobile.android.update.etbdd51/cache/oat_primary/x86_64/base.3302.tmp
Size 115KB
SHA256 b57136423986405a8b161cbf52d0b621c5fce597c3cfc9d2b1a321ec8e20b69f
MD5 9d10f9047b91fd9890d17b261c865c0b
SHA1 fc53ff505ad12d6f45d011cd1d7ffac66500da62
SHA512 13e8f0803bf776e8847beba282352f48ee1c0e5856be664589f7fce4ccacf9edcfba262323ad6a5c3bc13489053a26398dbb302141f8e56c3e359f9c6db97952
SSDEEP 1536:OX5keHtGQFk0BFTAR5ek7ITR58oF5LTEo0t+oCi7BUVYPqJrqyytJ0RAvJZWW5+5:O9NNTTwbITR5vsAo7UVYorsRLP
TLSH
T14EC3E85FE9A39011C0FB9EF79B8F66ECF91E8124160E2E0094717B7F9419A15F760BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileInstalled

Path /data/data/net.mobile.android.update.etbdd51/files/profileInstalled
Size 24B
SHA256 6e6c51b56dcf583498f15242ce678c1fc1a40e296b7a8a02279c74003f6f7a48
MD5 ae8c5c943c9e02c14a0cd7e180c87ff3
SHA1 03e2cf9cd82e5afac14989a260042b794c536b9b
SHA512 d3b8cdba94d481f9a4228d4724181726450ed320a9caafdadca5dd222f5d078f58110fc9056df83269a24eb7911eef8a356adcde4e250ff1b3078bae346ba545
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/net.mobile.android.update.etbdd51/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 e72001cbaa149cb36c231b9968754d550432c1657620232ac9a46dab67a13679
MD5 4a19c77431a8f8a5d030cdfc4d90ed50
SHA1 1b8a2c9aa3b74254a535d968a1e7d4ba7a118d4e
SHA512 d13be0b219a15fae4799c139e9ef1ea9df20d0da4ba3eee8fb89abe6d25ec391fd0d363cab09b14aba7a8e1702ccf94b62d797477150b65172a3dea8e01948fd
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/net.mobile.android.update.etbdd51/primary.prof
Size 1KB
SHA256 d9e5c8a2dbc287ac32ffde5e84e3a970ca3109cd09e90a4b8f687c7d6df69369
MD5 65cc4189d6244b7b2d82fcb37b7a47d7
SHA1 06d0dc770b99bc58a8894a49dc288ced6ea32cb7
SHA512 5885d23cf321847de4ae30a7b4fe5c4352a752d3b3d223a9b2822048df365b4f187a4bf8c09eeb9aebba7b815465d198635c0cf4cd357835075d9a352d8e3d90
TLSH
T1EE21E7EBDAA17714F96590B68C6BA91D1CB6D00B118F13D1003C57C29E09DECC80BCBC
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof.x0hqnO.tmp

Path /data/misc/profiles/cur/0/net.mobile.android.update.etbdd51/primary.prof.x0hqnO.tmp
Size 1KB
SHA256 5ac6ce73a5d0032867acbd8d6da2dd102ce7b02fab177a18343a9a086830064c
MD5 13c46d75469d84cf3e9da5bbb2baa4b3
SHA1 549c0dcea50b357d0a2e3245cfe8e2bacf8f09df
SHA512 76d7d68b1fcda6bc7affb63eb6d716d9242628f0508b4fc59df99341d3e183a75b98640ecafdb105fb8701b35aba422f8794e0405fea7149463eb08893121c95
TLSH
T16C211D1083C251EFD1558A703F642C29D78D8ACD294676C060D047326087F48D435C0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads