990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646

Analysis

max time kernel
152s
max time network
155s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
10/04/2024, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646.apk
Size

406KB
MD5

369ca8fd7af4865752c2241884e3b2cf
SHA1

ef4ea8f1ed83abbac62ed75b74cbf9c815887b3b
SHA256

990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646
SHA512

1dfd768f803959f8e79331459fabb5fe5b7fed6550b952ac734f41b694ec2a72811ec34b5ae88fc2d444221ba77df4b384c95f58442b0eb138a9a497a800914c
SSDEEP

12288:9oIrRitNNC4ZulrkFAIlniM2XtQHKvZIcaEWI:9oCo922bWXKHKvHdX

Score

8^/10

collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5045	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:5045

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
d505db4bb9a0c36589db4d1853867791

SHA1
aad475b5974f46d8cb5eae497a1fa541ffee99c6

SHA256
6d82ef6a44919e1e77d94e4d6fcfb33b0f04d48a7846fafa58d343b20968af32

SHA512
2edfc04b01683a4df0ae3b5ceb7b34448f06551743689842f18ce88ff979577171ccbc179ca6f06f1e238dfdbe035e411239797ae23780ddb35a778fe6d03a87

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
7815cd3e1b9c9139cfe4a623adc56a0d

SHA1
a6f6fa2cca8ba56816e3f5503c6e6c36603d82eb

SHA256
5c537248e934452bef8905f58f9aa4572a57c919eff69b43eaa5983621120185

SHA512
3dad30f56d17b4f5090f8f84444ed1aa22f2197d48aa53ac87517d8db2c87bd711bb3bbadf4b2e5df1353f9ac222d8851628afbcf8b5df776b81bd16cc2e2f63

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
24bd1349fd17e3d7f1fdd2a81f5bbbd9

SHA1
51376796715791136b158d4dda429157fa3c8ee9

SHA256
8a6782c411e5aa5ed8fb8e781d411b80a7608cfb3e1b7a67592b5e394095aed4

SHA512
b000afcf0a08b2827dfd98fab80c72ce850b8bc4c31a4322a2e78eb3a43dcc56e80a78e075cdabfdb947abe88da7ba98441001df029741b4ff4b5dc621884e59

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
bc740d47e143cd09d03bed851e7cf878

SHA1
bc95481c5243c7bbe845e0672ba666053bf26b82

SHA256
7ea157f36572ec849209e258e5515851703997995347a385b1c5fe5467fe0048

SHA512
6a5e163b357b3bdf1c264900263f80daa328c8309f3e8c953826ede5c2e8c8bf6b0f9b6e39804ee437765075345c8cdcb038ed59d5c075374b38df538ca8cc20

Download Submit
/data/data/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
ea628e04765adaf4238a5dcdff4bbd51

SHA1
a801947619ea8c368efe9c006a324dc6339ac60b

SHA256
885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4

SHA512
c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
d2e2bd6d91beafc5d27d52c333ced5a0

SHA1
fae6d41087afd6ef4dc018f6c7fba35f132e43f3

SHA256
320a087fe8c8ffbb1cff7d7aa9aec62b8f278dc36545bca224660bc646e3dd12

SHA512
697ef5132bb68a156a60600724757d70d95ec3213a4ab02dd75bfa8fce7f4eee46e4f4bcb082d512f69ed3b7398be84fc0c66ff378f78f93dec32a51e793b0bf

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
8KB

MD5
c79b7f932b2f69bca5b529e8b6091a34

SHA1
c0c96d895b18fff068ec63cd66226a0f1a24bafb

SHA256
9a92ee892d5cc5383cf5b7f0648a5653ac2cfe4567490a544a9ed6fa441197c0

SHA512
fa301fb0b74e4fae472aa5b6e4acf77d474d53122787bb5f39fcce818f62fc980c5ea9b9e7a4871914b04120ed6c283d2791ad177b4363b0589fd7d7ac73c6ae

Download Submit
/storage/emulated/0/Android/data/tmp/map.dat

Filesize
116B

MD5
e14003792b7892ceb645b64f778e4def

SHA1
649fc04c4ec390a321068fc81a4e9a99f4d5c0f0

SHA256
982fc25ce0cbda9b2ed112ede1a8e105a0d2ccbc97ec804e860b6781cc2ca546

SHA512
e8f5b4f913b7bd7a0fbca1ba9506aace6adc7e74634df365ee92abe058ea2d1a0b766dcf9ff7e2b78a4bbde9b29208f12e3c83b8a7bb4eab252482ca85ab6432

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads