79c69b0ea10b2dff77c16ea3a1851cf6000aa2542cf75100747d31e57d1e8c47

Resubmissions

07/10/2026, 15:16

261007-snpagacs6m6

07/10/2026, 03:32

261007-d3yecscz3m6

Analysis

user interaction
yes
max time kernel
65s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
07/10/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Config (6).apk
Size 4.5MB
Sample261007-d3yecscz3m
SHA256 79c69b0ea10b2dff77c16ea3a1851cf6000aa2542cf75100747d31e57d1e8c47
MD5 873af47f84fd2b40c97a8cfe9e3af693
SHA1 d7f9976d65d89930d5c4a96cf40acad5a8be7186
SHA512 568c0198de5e8f93e72fdd8bc2454c30228145320be197e87ec1c49321577c67c8e29d021168a7cdec5f33c13554f9a1db14c9a4a4a5f98c5c110c73be97d334
SSDEEP 98304:k0a0MlN7fP/nfmJWlxFfRUQi3ZU2dLK2mPFe/7rZV+UgOA4OxfnuKDu6:kzBnP/OJ8FpUbZtLa9irZV+UgHP/u2u6
TLSH
T13E263303C31FECACDAF18772EBB34313A2719856C387A35B9E5862A514873D49F05AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.util.updater.v5854002

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
54	checkip.amazonaws.com

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.util.updater.v5854002

com.util.updater.v5854002
1⤵
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
PID:4735

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads