0d9e970507baf8216c3a338d09d24e47d78a500b3b20d08836a8dc0e0282aeac

Analysis

user interaction
yes
max time kernel
5s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
02/11/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d9e970507baf8216c3a338d09d24e47d78a500b3b20d08836a8dc0e0282aeac.apk
Size 8.0MB
Sample261102-rydq2st1hs
SHA256 0d9e970507baf8216c3a338d09d24e47d78a500b3b20d08836a8dc0e0282aeac
MD5 4e0924f11ece87878e39bc7f769a1d88
SHA1 ffcf6946f38e6d14946224fa5411aca9abc8270e
SHA512 62db535d239b657d5fa18bb9d94a4e0edf74695675371f3dc5b74b1277ed2ef0d5fe0c4f1bd5055dea4f26807dab0858ea3528ccb893925ce03eb8297377b844
SSDEEP 196608:+FK+X+sqszSbuwYFRphm96/3X8YonCFX+NHo3p4:+9Xuuquwyu6/X0nCFOaZ4
TLSH
T1EF86333BF9023C28D7DE083381BEB9B736BC95EDD121C95386A5AA1A331536F948701C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion impact

Malware Config

Signatures

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.sec.google.android.gmscore.esg38w4w

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.sec.google.android.gmscore.esg38w4w

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sec.google.android.gmscore.esg38w4w

com.sec.google.android.gmscore.esg38w4w
1⤵
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4776

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

base.apk

Path /data/data/com.sec.google.android.gmscore.esg38w4w/cache/updates/base.apk
Size 7.0MB
SHA256 69f26a5dc5dc7a7754baad19769e61d71f331527705849ceb6af813f25a1d182
MD5 4f5a62560c2960250edadc37e13fe328
SHA1 0528e856d461dd1057139454bbb3a7c826cfa96d
SHA512 400c74bbee149b47df25338c16e06ee13fe0f742efcdbc7e3ee3309cf54dcd996ff15cbaa02dd9fcc8160dca5fa4e4f26607f38d99d3c1adfd703be9ca31465b
SSDEEP 196608:Hq8jgyKpQzO7IhvE5FJjFLnI5hOz8U7Oxx:Jgf2zO7IhAjFLI5W7q
TLSH
T1B376CF06F645986AC7E69135CE6A82325721BC5C83F381F33554BAE83D736D87B29BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads