be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f

Analysis

max time kernel
144s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f.apk
Size

248KB
MD5

54ae16a13dd825ef0589cd5e78a6f356
SHA1

f16e355715924d9e37b6134433e312899f4501cf
SHA256

be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f
SHA512

04066aa21ae6ac5786ec016a428c207aaf062d96d99a8ba20127b08333ed3bfc82df8e1052aebe75d2621aa7fd95ef33b334d9936e45a4825685edd8d2f12302
SSDEEP

6144:J7iq53RZ3wVazR4GXzwupzH6fDLkXWnXXuqdiMrz:NiqlR6Va6GDT2PkXWnngMrz

Score

8^/10

collection discovery evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4272	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4272
- su
  2⤵
  PID:4301

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
d5950b4302984c62ae015c70f8359000

SHA1
44de2b51c2942afc6706cfd591bd17e0b22732a2

SHA256
b25855280d949ff775756116e72d78ac73561352dfa33866835ccd355d037f9d

SHA512
39c732e681ba5913a12d78056a128a2f7a2cf3b78f5735727e629b15bd5f498ea22ca1bee6bd0c7580c2443cc08e4416c454679bf52ca34fb91366f6374b334c

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
6a809806cfa8cff254e61ef58b75c3d5

SHA1
9213004b7e6fe79b7f8e485246a4f4f131eefa36

SHA256
db56bef0a5c416088d37ecb055eadca50743d94d2a56929db7932910719a8fd8

SHA512
379fef304033db372860ef28e0aea6d3bbfba2ad1634d412ef1549eb8d3a6a0eaf2b84889136eb163d71cb5d4fbe381ee59aa847c3c88c706557d29e0071b48e

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-wal

Filesize
32KB

MD5
cc4982fb02dbb21af1cae4ad581da18e

SHA1
f183e808af5a3ac92db9ff242fd189e3924a6a3e

SHA256
f9e060194a4d7f91ac977eb0337e80b4c2b537a07458273c1d2c3cf9ed279196

SHA512
afb2c60821eb0ce0072cf6c3edf68bf80fdb8036fff23f005d8693d28b18903500f2413235452d741dde659d96fb17db4e4685b5d71d3d4768142cdc3825f7cc

Download Submit
/data/data/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
3fe30614d7e0d11db870b4624f6c50e0

SHA1
053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

SHA256
67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

SHA512
c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
830a999d42c7be64ff23b5f15fad1f69

SHA1
877a986fe6fb355e72f1dcbbd9a91e12e54c93e3

SHA256
4ae442100ab428ea064924261617bb5aee67cd1736a302706a24c249f1c87ade

SHA512
da11da718e992249854065429dc1f588caa2e299e14b0e2cbe4c589437e6b3cfa803de731bf8311b47c2b2fda5d46898558c53191b8e6de16912dcd8f873b8e1

Download Submit
/data/data/com.photo.android.p/databases/hmdb-wal

Filesize
16KB

MD5
7e1998af9daa22bf02b49df27b4c007b

SHA1
d97fa151775025a774fe668fbfce79d32ed48db4

SHA256
e7a5e261a3f22e1252b2046226f356ef76364b2b5f09e2d2200cc4cf00df4767

SHA512
3be2e891ddc6c629637808846f3fecc8195a6571727b8d9a95415f152035108ed4cf75b523b482dc6013a1a561b19af37a51d0556a0565f71ed5a8eda9c492fd

Download Submit
/storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712757427

Filesize
917B

MD5
bf6a43d095e7b3bfb79376edf4af507b

SHA1
011fc0bacaf8cc4bd6e620c46a20d4c616f6c916

SHA256
1994fcfe3d50104314ee19fd655a25b5cfefdea0c6ae773952ef61ad9876af42

SHA512
8352c295b7e84b5edeedd92ed99fd90383cea006443ad8d8f851e15d2a5fdcdaab08797610d4bdee1171450524f60d3ab39eeb9a94f808a93a8b524693c8a108

Download Submit
/storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712757427

Filesize
2KB

MD5
7dc8c16803e694f7f3a94f4da4568c16

SHA1
669009e53a76c11e556e89ef2ab5afdbded891e8

SHA256
85dd18f45bc272ed054643c7bed3ed1806c8715ee4db707561f5bf8fd9fe393e

SHA512
d3eb7da0ac412b396e20ba939fd60bc83af466f806e103c6b69dc80604799fbc1cbad9ac82944b509723560328d7639f774977e413bbf9ab255b5179dda7df2a

Download Submit
/storage/emulated/0/Android/data/tmp/map.dat

Filesize
109B

MD5
2183d1f9ff487f08381a0d9a813ae9b8

SHA1
eca74c37e811308c22352f7fe919d784d6a98f92

SHA256
5ae554d57f3842f8b16f29ca703143a34f3625fc1bb6b611e3c5863c04e05e56

SHA512
2557986b9d34a6520c275e8ebaa6b8908e59273d68e80a1ed12d0ebcae019b9348c9367790f8c74a407b9643ae0ce17a9b44991de9ea3cd2239b3ed9e2c301a7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads