13e457ce16c0fe24ad0f4fe41a6ad251ebffb2fdaaebe7df094d7852ba0cfdc6

Analysis

max time kernel
149s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13e457ce16c0fe24ad0f4fe41a6ad251ebffb2fdaaebe7df094d7852ba0cfdc6.apk
Size 221KB
Sample240410-lpmppsba46
SHA256 13e457ce16c0fe24ad0f4fe41a6ad251ebffb2fdaaebe7df094d7852ba0cfdc6
MD5 8365c4d4f996f31e6ae3f3be95259b01
SHA1 80d86ea2ca36ffa2519eba6b6c866f321b801110
SHA512 1d26cd43331f3d3ce30a3e7c7cf7ae75bc5f8ae08b0fe8b720e945a3fd5c29b57742f37a037db353a166b80108f4be76fd7b9b902f96f5f80110a9fb3d7817f9
SSDEEP 6144:vjmsUZ3w47zMnNp0NYUP/xLHHuHBKN1ej+:vSsU643MnNp+fP/9Cj+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4474	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4474
- su
  2⤵
  PID:4502

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dynamicamapfile.db

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db
Size 20KB
SHA256 b25855280d949ff775756116e72d78ac73561352dfa33866835ccd355d037f9d
MD5 d5950b4302984c62ae015c70f8359000
SHA1 44de2b51c2942afc6706cfd591bd17e0b22732a2
SHA512 39c732e681ba5913a12d78056a128a2f7a2cf3b78f5735727e629b15bd5f498ea22ca1bee6bd0c7580c2443cc08e4416c454679bf52ca34fb91366f6374b334c
SSDEEP 12:TDz3yNTSFbymHuYU49M7mW/fPIGQYcVRmBEyPbAVOwG:TiR7lvGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 512B
SHA256 46e964b99db08fe293fbeceb17f27431251369aee59c7aa2ee066abc0e15d784
MD5 580b763e25d5e9c51a845d8cbf065db2
SHA1 b05b0554c73c71ec2d8d3199fa9cb5251d259aa4
SHA512 aa4099ed3734b4cad0825eca5653778a9589dc9d28afe35479e1cb0618fcaa464d0dc3bce8779a1596357938790a75bcfe155a2ff3c5a7faa6ab9fd63c75eb72
MD5 SHA1 SHA512

Submit Download

dynamicamapfile.db-shm

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

dynamicamapfile.db-wal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-wal
Size 32KB
SHA256 2599ef6d2c03fa2e0ae4365065bf3b43fb2363d9d09ccad9e3989c323e1b2b49
MD5 e88b7b703088973023fd9c13f423ca6a
SHA1 e9c600ee12ea656e5a9ffad9ec993deed04ec7a2
SHA512 ee9a1ee223856bbab39d253b5bacf4929af169753375377bf8093a7f5842d55e0535c327a9a3051731e563cf3f021d029dd04c8cba784673e745bb2ac37ceefb
SSDEEP 12:KQtTzdTRmBEyPbP/pX9HUOwCl+5Dz3yNTSFbymHuYU49M7mW/fPIGQYcVRmBEyPv:KoTzyGSP/pX9H+t5iR7lvGSP/ey/
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb

Path /data/data/com.photo.android.p/databases/hmdb
Size 12KB
SHA256 67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
MD5 3fe30614d7e0d11db870b4624f6c50e0
SHA1 053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA512 c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae
SSDEEP 6:l9FZdrlOERX4PBX4ogLugMBX4suuKTqiOw2:TzdTRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb-journal

Path /data/data/com.photo.android.p/databases/hmdb-journal
Size 512B
SHA256 c8a711dd4539f70f14f76ebd1d2a37c12ff69797e06940cad25bfc875f2cbc3c
MD5 b2ab53baed3efb0b1ae188358f839bd5
SHA1 7cd12baa88b16153450dadaa584f5e70095b4dcb
SHA512 3aa220c738180fba1218eb0a9f341b8743f813db52899826db04270b9860c0e4fd704672a6fdc1adbf08705ac7c6b1bac230e876067273906457c78c21dcb7fc
MD5 SHA1 SHA512

Submit Download

hmdb-wal

Path /data/data/com.photo.android.p/databases/hmdb-wal
Size 16KB
SHA256 f776fe3b5d952aa321efd41e20d70fd8778387a60a154968453b563eb5ba84ff
MD5 3c5ad8aa2757178d763c7db9ea1a0ce5
SHA1 b420fa359e35074746d3684b4704cd505f1c3207
SHA512 e5bb2f59b4d616cfcf1ccd1c98fd982dd1c6d0ce9d228c373353c6654189111b22b24347a6c72e2966bd97a3834d5915829a78a1cfb869f78a3599db410a77a9
SSDEEP 6:Kyh9keMUE9FZdrlOERX4PBX4ogLugMBX4suuK+/McBI7D79QByDAOw2:Kyh9keMxzdTRmBEyPbP/McS7DZa7Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

1712742174

Path /storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712742174
Size 917B
SHA256 d2ffc9f1d4d2d317e74dd8b2d54f123663762c9186120f6a02c93964e19ee62e
MD5 c78527b906ddd60dc5b943676a5ca033
SHA1 e8dd89d5297354a3fd61dc2607f10ad84771748f
SHA512 18cd7be4dd94c35b5656a8dd4d6547d83845be541da8374c74b5f40e9643965299cdd5653f81d81882dac93e01d89892ca0ad0870741d5a5b5f3b3482f93a7b2
MD5 SHA1 SHA512

Submit Download

1712742174

Path /storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712742174
Size 2KB
SHA256 921d3407ff44096f7d219b7640d01559566b3d0d5606896e6554fd21cdfcba1b
MD5 7ef8f739759e72192f9730d28974c966
SHA1 692a14793e81a869633e2e4c1663a591550277c5
SHA512 b86dc782f3a4b76fdf6c3362cb5dc018e78a159477e509871b83be45cdc7bf56ade176d2736fe0b72ae68dd946485fd01942ad35354bc5371e565042c6ae085c
MD5 SHA1 SHA512

Submit Download

map.dat

Path /storage/emulated/0/Android/data/tmp/map.dat
Size 109B
SHA256 77c5bbc30dd017973fb324d2ac5775ea8c24c1e27be91f691f11b03ddb840167
MD5 547be2c911a8b8062aa9e0a3f9178fbb
SHA1 7ad65bb0efabd627ba77a515b8160fb860d14372
SHA512 e194e615b73d934da77a1188011a92801adceb4e962d92579fb16dc326c465be40566aae75c81aa3e52bfaa5661edff41f9d6aba17dd06bd49d8e760d4229356
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads