I have been doing some malicious APK threat detection by our security threat detection app I have been doing some malicious APK threat detection using zIPS test automation.
I was able to copy file(sideloaded_malicious_file.apk) from laptop on to an Android(iOS later stage) device under folder “/sdcard” using pushFile Appium command.
First I could not physically verify the copied malicious apk file in the file structure of the device. After installing few third party file managers, I could able to locate a file called appiump.tmp with the exact file size and the time of transfer under the 'internal storage' folder.
When I check using programmatically to locate (sideloaded_malicious_file.apk) file, it is locatable. This is causing our security threat detection app, fail to detect the malicious application presence in the device.
Why Android or Appium (???) is changing the name from (sideloaded_malicious_file.apk) to appiump.tmp ??
It is required to be prevented, the reason being our security threat detection app need to identify it as it is like a malicious file, and detect it and list it in the threats, and show a pop up that a malicious file is being found.