990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646

General

Target
990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646.apk
Size 406KB
Sample240410-p4wspsbd9v
SHA256 990e50ce20706be80b4d62367ff6ed615d6dd04551b42cfd80b1a8950065b646
MD5 369ca8fd7af4865752c2241884e3b2cf
SHA1 ef4ea8f1ed83abbac62ed75b74cbf9c815887b3b
SHA512 1dfd768f803959f8e79331459fabb5fe5b7fed6550b952ac734f41b694ec2a72811ec34b5ae88fc2d444221ba77df4b384c95f58442b0eb138a9a497a800914c
SSDEEP 12288:9oIrRitNNC4ZulrkFAIlniM2XtQHKvZIcaEWI:9oCo922bWXKHKvHdX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5045	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:5045

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Location Tracking

1

T1430

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dynamicamapfile.db

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db
Size 20KB
SHA256 6d82ef6a44919e1e77d94e4d6fcfb33b0f04d48a7846fafa58d343b20968af32
MD5 d505db4bb9a0c36589db4d1853867791
SHA1 aad475b5974f46d8cb5eae497a1fa541ffee99c6
SHA512 2edfc04b01683a4df0ae3b5ceb7b34448f06551743689842f18ce88ff979577171ccbc179ca6f06f1e238dfdbe035e411239797ae23780ddb35a778fe6d03a87
SSDEEP 12:TLmk3yNTSFbymHuYU49M7mW/fPIGQYcVRmBEyPbAVOwG:TLkR7lvGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 512B
SHA256 5c537248e934452bef8905f58f9aa4572a57c919eff69b43eaa5983621120185
MD5 7815cd3e1b9c9139cfe4a623adc56a0d
SHA1 a6f6fa2cca8ba56816e3f5503c6e6c36603d82eb
SHA512 3dad30f56d17b4f5090f8f84444ed1aa22f2197d48aa53ac87517d8db2c87bd711bb3bbadf4b2e5df1353f9ac222d8851628afbcf8b5df776b81bd16cc2e2f63
MD5 SHA1 SHA512

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 8KB
SHA256 8a6782c411e5aa5ed8fb8e781d411b80a7608cfb3e1b7a67592b5e394095aed4
MD5 24bd1349fd17e3d7f1fdd2a81f5bbbd9
SHA1 51376796715791136b158d4dda429157fa3c8ee9
SHA512 b000afcf0a08b2827dfd98fab80c72ce850b8bc4c31a4322a2e78eb3a43dcc56e80a78e075cdabfdb947abe88da7ba98441001df029741b4ff4b5dc621884e59
SSDEEP 6:7+/l9Han1Vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKw9:7+tlKqLiuWdwRmBEyPbz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dynamicamapfile.db-journal

Path /data/data/com.photo.android.p/databases/dynamicamapfile.db-journal
Size 8KB
SHA256 7ea157f36572ec849209e258e5515851703997995347a385b1c5fe5467fe0048
MD5 bc740d47e143cd09d03bed851e7cf878
SHA1 bc95481c5243c7bbe845e0672ba666053bf26b82
SHA512 6a5e163b357b3bdf1c264900263f80daa328c8309f3e8c953826ede5c2e8c8bf6b0f9b6e39804ee437765075345c8cdcb038ed59d5c075374b38df538ca8cc20
SSDEEP 6:7+/l9UPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKYlvM/5:7+t2qLJdTRmBEyPb5s5
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb

Path /data/data/com.photo.android.p/databases/hmdb
Size 12KB
SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
MD5 ea628e04765adaf4238a5dcdff4bbd51
SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
SSDEEP 6:l9bNFlLdrlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdTRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmdb-journal

Path /data/data/com.photo.android.p/databases/hmdb-journal
Size 512B
SHA256 320a087fe8c8ffbb1cff7d7aa9aec62b8f278dc36545bca224660bc646e3dd12
MD5 d2e2bd6d91beafc5d27d52c333ced5a0
SHA1 fae6d41087afd6ef4dc018f6c7fba35f132e43f3
SHA512 697ef5132bb68a156a60600724757d70d95ec3213a4ab02dd75bfa8fce7f4eee46e4f4bcb082d512f69ed3b7398be84fc0c66ff378f78f93dec32a51e793b0bf
MD5 SHA1 SHA512

Submit Download

hmdb-journal

Path /data/data/com.photo.android.p/databases/hmdb-journal
Size 8KB
SHA256 9a92ee892d5cc5383cf5b7f0648a5653ac2cfe4567490a544a9ed6fa441197c0
MD5 c79b7f932b2f69bca5b529e8b6091a34
SHA1 c0c96d895b18fff068ec63cd66226a0f1a24bafb
SHA512 fa301fb0b74e4fae472aa5b6e4acf77d474d53122787bb5f39fcce818f62fc980c5ea9b9e7a4871914b04120ed6c283d2791ad177b4363b0589fd7d7ac73c6ae
SSDEEP 6:7+/l9I8Zn1Qdvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK9:7+tTAtqLiuWdwRmBEyPb+
MD5 SHA1 SHA512 SSDEEP

Submit Download

map.dat

Path /storage/emulated/0/Android/data/tmp/map.dat
Size 116B
SHA256 982fc25ce0cbda9b2ed112ede1a8e105a0d2ccbc97ec804e860b6781cc2ca546
MD5 e14003792b7892ceb645b64f778e4def
SHA1 649fc04c4ec390a321068fc81a4e9a99f4d5c0f0
SHA512 e8f5b4f913b7bd7a0fbca1ba9506aace6adc7e74634df365ee92abe058ea2d1a0b766dcf9ff7e2b78a4bbde9b29208f12e3c83b8a7bb4eab252482ca85ab6432
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads