13e457ce16c0fe24ad0f4fe41a6ad251ebffb2fdaaebe7df094d7852ba0cfdc6

General

Target
13e457ce16c0fe24ad0f4fe41a6ad251ebffb2fdaaebe7df094d7852ba0cfdc6.apk
Size 221KB
Sample240410-lpmppsba46
SHA256 13e457ce16c0fe24ad0f4fe41a6ad251ebffb2fdaaebe7df094d7852ba0cfdc6
MD5 8365c4d4f996f31e6ae3f3be95259b01
SHA1 80d86ea2ca36ffa2519eba6b6c866f321b801110
SHA512 1d26cd43331f3d3ce30a3e7c7cf7ae75bc5f8ae08b0fe8b720e945a3fd5c29b57742f37a037db353a166b80108f4be76fd7b9b902f96f5f80110a9fb3d7817f9
SSDEEP 6144:vjmsUZ3w47zMnNp0NYUP/xLHHuHBKN1ej+:vSsU643MnNp+fP/9Cj+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5030	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:5030

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Location Tracking

1

T1430

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dynamicamapfile.db

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db
Size 20KB
SHA256 6d82ef6a44919e1e77d94e4d6fcfb33b0f04d48a7846fafa58d343b20968af32
MD5 d505db4bb9a0c36589db4d1853867791
SHA1 aad475b5974f46d8cb5eae497a1fa541ffee99c6
SHA512 2edfc04b01683a4df0ae3b5ceb7b34448f06551743689842f18ce88ff979577171ccbc179ca6f06f1e238dfdbe035e411239797ae23780ddb35a778fe6d03a87
SSDEEP 12:TLmk3yNTSFbymHuYU49M7mW/fPIGQYcVRmBEyPbAVOwG:TLkR7lvGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 512B
SHA256 f0364e9094489bff21bb19ddefbfcb8963b411d907572fc529d53d163a5c7bf3
MD5 768179f5792f76f09aaa364942f4851c
SHA1 bacfec9f4b8e4830a64dec2d3e048a93ad7bff6b
SHA512 ed259ddc00ea3ff1bd9bdf0b3874debac36b66aa7a20846c8ee7881110f5a292e45911f1037e346b5567890fd92f504f3a3978bc8680b758f309676050be236b
MD5 SHA1 SHA512

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 8KB
SHA256 ecf558a62539ded03b5d9ebcea306193e094e72bd65b838a09a7660e520b9ad0
MD5 4d7f778bb04ab7475b38dffb2afa61db
SHA1 fd8657a067347ff12ef466d02e6f8989e43bf338
SHA512 0e50799cef7a11d42f7f893193ca9f03aaa96c29e1c8bcd8667aab6ca4a97127fba36471b8d949a06834cbef6e1b26a3fb87f3c9544b91c34bf3cd90699deccc
SSDEEP 6:7+/l9ZPgn1t//vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKO:7+tL0/nqLiuWdwRmBEyPbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 8KB
SHA256 566db7fd91ed70b0902f5bd112ec292817451c6c9f1aff703a983ac91acfe778
MD5 8012a88445f17b151e810b4fc9c8287a
SHA1 29e5b4b52267ea6a7a5a3a2af2fa2c8ac69b4442
SHA512 72f1d69cd1c85d945123db18726a0d82f0d15d76220bd5b9b91f92977e9525f925056e7392f82a6d632d791aa601135876777168b61aa66bf7eb26b363aea756
SSDEEP 6:7+/l9dGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKV//eQ:7+tD6qLJdTRmBEyPbW9
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb

Path /data/data/com.photo.android.p/databases/hmdb
Size 12KB
SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
MD5 ea628e04765adaf4238a5dcdff4bbd51
SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
SSDEEP 6:l9bNFlLdrlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdTRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb-journal

Path /data/data/com.photo.android.p/databases/hmdb-journal
Size 512B
SHA256 60a1b9688c5372690d79686bc6ec45772ad486caf9c9ecfa1e92233e0062f258
MD5 e227b56014981b8b8241000cfc2aedd9
SHA1 b4cc57b6492270bcb0eb54af92fca50d1c8faf8a
SHA512 91b119b6153b06ef01caa538a9c0dcbd1fa785a003eee60dc95a49a3302a84567ccf2f80e697706d314d87eeb9451025e689534627c92cb7b0a06c3157293745
MD5 SHA1 SHA512

Submit Download

hmdb-journal

Path /data/data/com.photo.android.p/databases/hmdb-journal
Size 8KB
SHA256 7a304e15e27c5d2388263a149875a97b2325598aa58ed956a20710b3a64a8d94
MD5 46100e993f6652e27263b5a99fcd655c
SHA1 73fb956dbb650f6932d449dc9ecba2b2bd9b76cd
SHA512 4422efd2d57ec4ab44f1fef3d9b4a8463f379a0376caceaa6e99c46507638d88021be6f75815ec8e2aaf918f7d2339e1fab3e47bd8951012427ce4355e1c83ec
SSDEEP 6:7+/l9Dbn1Mg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK48:7+theqLiuWdwRmBEyPb6
MD5 SHA1 SHA512 SSDEEP

Submit Download

map.dat

Path /storage/emulated/0/Android/data/tmp/map.dat
Size 109B
SHA256 527f8e706cb76cbefb5b99648e5f43d17687f23a57e7852b1453aa06b373ed91
MD5 b07bd57c8c55c715d95c52e3b0a0a459
SHA1 529c2577a7848e0f5dbccc573747ba66aaae2f1a
SHA512 2583401a2d584829b7e3dc54425d2d07d3146d360700e5c1e3b01a10dd8a233623092cd57f6c99b388e35fd9ab469e23d97073a338430013f8ba6ecac3f800d1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads