990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646

Analysis

max time kernel
144s
max time network
146s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646.apk
Size

406KB
MD5

369ca8fd7af4865752c2241884e3b2cf
SHA1

ef4ea8f1ed83abbac62ed75b74cbf9c815887b3b
SHA256

990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646
SHA512

1dfd768f803959f8e79331459fabb5fe5b7fed6550b952ac734f41b694ec2a72811ec34b5ae88fc2d444221ba77df4b384c95f58442b0eb138a9a497a800914c
SSDEEP

12288:9oIrRitNNC4ZulrkFAIlniM2XtQHKvZIcaEWI:9oCo922bWXKHKvHdX

Score

8^/10

collection discovery evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4267	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4267
- su
  2⤵
  PID:4297

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
d5950b4302984c62ae015c70f8359000

SHA1
44de2b51c2942afc6706cfd591bd17e0b22732a2

SHA256
b25855280d949ff775756116e72d78ac73561352dfa33866835ccd355d037f9d

SHA512
39c732e681ba5913a12d78056a128a2f7a2cf3b78f5735727e629b15bd5f498ea22ca1bee6bd0c7580c2443cc08e4416c454679bf52ca34fb91366f6374b334c

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
10fb2e9372088550a289ba4952d063a7

SHA1
e7f1408468150895aeedb0f7b1098a905f6afb78

SHA256
b27ad128d62c08644d50dd122fa38cedd5ac9d13710476b5cb3cdc6a26a2a23f

SHA512
60eb86bbaf3044990ecb367caadd6023a9b0cb91ad20b336dc36322cfac5a81bf1bd82b91e8346d5764139b88a146767eafbaa09fe3dce8bd0ee006b3b15d071

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-wal

Filesize
32KB

MD5
bc8ce5229c53bab91252d580601ce9b7

SHA1
b8b96609a4692fddc4d95b98e6c743a983784c15

SHA256
713b88a29ada16555fcf11df4eb48e43878f1630763bd3468fc8e7a46e0f1442

SHA512
59d169a402198d175e32f0aca96cc1b001f3e0910973aa08d9cb263dde8c7e458aa2743e0704dda65ff46fb23115caa7a5fb2b38a3153d605cb52252c02a00cc

Download Submit
/data/data/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
3fe30614d7e0d11db870b4624f6c50e0

SHA1
053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

SHA256
67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

SHA512
c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
4428ba8a78238c5f3361b5a2b0b458cd

SHA1
4ba62ac1ae868973e889698590679095587e19a4

SHA256
ab3bd5539e34d46b2917fd2a8aa07e1a6f49c6569374592c4e44df6fe034479f

SHA512
c9502a7f682229a7fbaeae6f762eb62ef65fa12f39b39cf147c126229e18daee83d1d2a023a9f48d0d0453f091711fac42e6844f7a09dd09e7950808de0ac95c

Download Submit
/data/data/com.photo.android.p/databases/hmdb-wal

Filesize
16KB

MD5
65a625a7d873cef6ed25cf56251a569d

SHA1
1a64f58ae00e5402ad7e961fe9b9a118dd73754a

SHA256
06758a2c9a646580bc7ccf9c8ba89efdcbf26aeb9914be06b6ff137f6b58644f

SHA512
bbf053b1e6dec18557ba71cdcbe50a547e17a24313e8e56879684407bb62bb13a2bbcd454aff1bb4c9d7756d94cd38577bdba6f858a5690ebcc8e7949720ac41

Download Submit
/storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712753624

Filesize
924B

MD5
e898e8a91c40a5e13c72fb0066fdd4e7

SHA1
caf7e4704a811b5a412b9c735b1580c3331d1015

SHA256
56d8ae367362b8c68074eb82f8dc26f76e86b629d426c0776f94591e9be8ec08

SHA512
2e6c4e243ee8e44ad5ecd3cce9d6e5a61aca1cf7fe7d6337c216fa2f5b04ddcc5f864d2cc534f2f17a0b0fbb6e7b62c26f61f122f55b0e3bbd199fc54c4c6375

Download Submit
/storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712753624

Filesize
2KB

MD5
8ce95e47603fbd4e8eb877dffc2d1979

SHA1
6f307251feb2830bf5059e7d99cf8ea8cbaca0b7

SHA256
d5cd7529e51c7e115ca89ea0d9e7f43e36e8ed45c677e5a6e30c9b6bd7c5e062

SHA512
6eebba8bed60bc50ae7171171cf75d457e1a026fbd1cea46e021a3baa143440da6fbb1bd8d1e8a5d93d025dc353c9c63dc5baed1dcec7bcde905058c6787128b

Download Submit
/storage/emulated/0/Android/data/tmp/map.dat

Filesize
109B

MD5
8805701b446ace1c89a59620d27c2d8d

SHA1
795b93fee57ca89e524ed903ae299f385bb250dd

SHA256
bb0b2f460b63d8cfd5d3d089af2610b3cc89482746c587ee003f1192c09138e7

SHA512
00680c11b9f285fd7ab5b0d8c23569046b4e46123d8cc973e59089b31be0be6eb3f4f9b404b6e8ed3656c90b7a7f8799d97ac7bd71733f062266c3b2a08df596

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads