be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f

Analysis

max time kernel
144s
max time network
155s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
10/04/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f.apk
Size

248KB
MD5

54ae16a13dd825ef0589cd5e78a6f356
SHA1

f16e355715924d9e37b6134433e312899f4501cf
SHA256

be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f
SHA512

04066aa21ae6ac5786ec016a428c207aaf062d96d99a8ba20127b08333ed3bfc82df8e1052aebe75d2621aa7fd95ef33b334d9936e45a4825685edd8d2f12302
SSDEEP

6144:J7iq53RZ3wVazR4GXzwupzH6fDLkXWnXXuqdiMrz:NiqlR6Va6GDT2PkXWnngMrz

Score

8^/10

collection discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5034	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
PID:5034

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
d505db4bb9a0c36589db4d1853867791

SHA1
aad475b5974f46d8cb5eae497a1fa541ffee99c6

SHA256
6d82ef6a44919e1e77d94e4d6fcfb33b0f04d48a7846fafa58d343b20968af32

SHA512
2edfc04b01683a4df0ae3b5ceb7b34448f06551743689842f18ce88ff979577171ccbc179ca6f06f1e238dfdbe035e411239797ae23780ddb35a778fe6d03a87

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
f8b437f3c135712c027c2a059eba7ce3

SHA1
7d8f4b03a21703b235243743061447cab6435a07

SHA256
54c83082103410aa625e9b5c435625af0f169b1160e9460b767d22cf5dc65af9

SHA512
c544e3ee8fc415c860d071981b9c5f4e1b32075dea4abd6ac8b5ca864856ee013e3e282884855ee8560b76970c9246c6d140f92bbb296723c18deae9dcb898fe

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
0c5c23358ac9abb98812209dc1d4e739

SHA1
1a8dc6a4a7619bd92f85f1c47e42bd2d5fd7fca1

SHA256
73dbbbfe69c256c3c4c18288455650fd9d61a0a8352aad16c9e6768eafc0f84d

SHA512
1a2c4bb0f5198ab910205de01c0008a18e40f7c135cfdaec77eacaf0dceabfaa4c0d0a015fcad8752241072ccf77da41ce4fae33707256e940923fdd577eeb33

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
360082d1567c6f89a1585bf13ea9bdbc

SHA1
e77c0ce664d3d7068ead1df5114fc275ce46b4d5

SHA256
067c3a473382defcc740245c26e9294df8bb73daff25aa76f51cfde15e1550f2

SHA512
698129b2ca77ce56c36ed27d0d0071f50ef630f73867abf8db2c3f498d3cd84bd44913ed38f973f2d4e589e92370e29624b20f3e935bc11940cb21afa5f26269

Download Submit
/data/data/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
ea628e04765adaf4238a5dcdff4bbd51

SHA1
a801947619ea8c368efe9c006a324dc6339ac60b

SHA256
885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4

SHA512
c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
16aadfabf7eed9f578ff1e1b41a7ace4

SHA1
da5f52d780263fd6b1fdeda3d5e14146535fe5bd

SHA256
84da17f5f2fc15faa866a18f53316f2420fe597093b126f663603d18a202aced

SHA512
0e69cf137a0feb8037b9ab73790dd08760e5afe012e1dac87fa86d20b3f646de60a4c6e52e8492feb375c4cf1cfe18bb0d6508db04eebbf02aa47332908553bd

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
8KB

MD5
3e0f306979b5178a575915d3b6396532

SHA1
ebfa3949cb721579a116d50050603c83252a54b6

SHA256
1482a704e20f7396c2169cd03b023cab003c305f5f17cc4779a6eea8ac297ede

SHA512
8c63d8afa9474bec12b8f323cb23ba402ccd90ab3a745e807b845dc942cf93ed942f4e67518513d73f698d71c14c2967cf163113ef5dc30a5670d44e3d666ff1

Download Submit
/storage/emulated/0/Android/data/tmp/map.dat

Filesize
109B

MD5
ff86c98404290f8610612ddc14655fbf

SHA1
3a69050dbfff946a4c2576a9d6cf786a966e1fac

SHA256
59c58657e732c3d5d2738e597b5eca86d92db865de2edceaf44a6106cf7a6311

SHA512
83abc7fd91602a443fd1a2015286c1e201c42d229654007cb3f03bd7eef97c14534f525bef9aefbdcba181eda3f2ed0baea5921c8af9f2e25276723cd52879a2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads