be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f

Analysis

max time kernel
146s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
10/04/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f.apk
Size

248KB
MD5

54ae16a13dd825ef0589cd5e78a6f356
SHA1

f16e355715924d9e37b6134433e312899f4501cf
SHA256

be0ae4394b8592cd1325b86669fa78f9ccd320d23f839e81001138be914a760f
SHA512

04066aa21ae6ac5786ec016a428c207aaf062d96d99a8ba20127b08333ed3bfc82df8e1052aebe75d2621aa7fd95ef33b334d9936e45a4825685edd8d2f12302
SSDEEP

6144:J7iq53RZ3wVazR4GXzwupzH6fDLkXWnXXuqdiMrz:NiqlR6Va6GDT2PkXWnngMrz

Score

8^/10

collection discovery evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4609	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4609

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
4fa65216d7c7a0d708f0fc39947bc574

SHA1
df4d662c7336532c40ab966647bdfb2b74d8a0f0

SHA256
90efb1b89a9732f3da0cbfc20437ceb7a03e6607cbdb3eed1ddb8521e28c50c0

SHA512
9f38d1fb651f61a8b7c95460c0a6a55b7e0d60523c680f7f11d1fd8887078d6694ae5d68c2cd1207a86b8e7e8aeedf8117a6cea47d1fc38719be522be062063c

Download Submit
/data/user/0/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
eb359799d2439afed44d5c1702919fc9

SHA1
a7a53cbae7a8a24aba58a5dbcbba1b0837e28ed7

SHA256
cb8c06624473c7ed6946fe31a90bb76a39aa72063f16656c9c9c01fdc5bb2408

SHA512
d63144a571e6c74fc61b9f0cdd8c6a80d6f7c5fc38b7b0fafe40effdff8b65a5482253421d38952985e014f3dedc128b22f1fd3f75f400f825693cda90cbb9ce

Download Submit
/data/user/0/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
17f7c2f450f016362950f08e1e7f7cb8

SHA1
9119d8f369ee1814bdd00799733da99d1030cb14

SHA256
2ceb056302dce3a51fb8fd445823040d69970d3b4d4f48ec4a7663c72f0d291b

SHA512
af5559e88b8158d7abbba847844e9a6a93cc74a9674aa8cde96112edfa127e83f3163773c05d66adc310c33dc633537649f2da1cd25cceafd7d386c91c9ff457

Download Submit
/data/user/0/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
8719e1331f2998cf19a204f21b78b6d6

SHA1
18ce2dc6f3decf997ac8244eb58b4dc91dc1f8c4

SHA256
fcb9262d2968a3c147a97116a8bce1e9e7aa9d7d03a6bd02a5ef89bb3008b4a2

SHA512
42b104baf9257314e7e15f86b7e20ada5700b3821810f48ce3b5dae4350e0cbca6001d2e9451aa74ca43715cbe0fc6034ace1810a6cd74365d1f8115d802f93c

Download Submit
/data/user/0/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
171aedf968e17a2744d2585715606cb9

SHA1
bbeddeb3b89fcf809619c35b4a318a80e7d5b029

SHA256
d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e

SHA512
78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

Download Submit
/data/user/0/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
9237fe7405e759928d8a1a0fa1fa3df4

SHA1
bd4a24266511715959d490a6d250af7907e54b42

SHA256
b9080a07470baa6f2de1086aa91e060d428610e0a432efc5f0cca5d334bc7ec1

SHA512
f42dd87c3b4f7b46fc40b075dd7d3bb9c037c68d25f751da4d318013f14661cc2d35195ccbf7a3b2417a18a17b220d95b32e022c8ab9eb8062f03351057614b3

Download Submit
/data/user/0/com.photo.android.p/databases/hmdb-journal

Filesize
8KB

MD5
2cdd1549994facb25213b024914e74ff

SHA1
01d278efc993d35888ba9711b882848850a7ce28

SHA256
438490bbb831f6253e54509a23ec4608360208f8843ce7e498bdc9ef170a569e

SHA512
52fe8115d47f36c665f25727a9674b45bdccc3a2b885b8c4f7d3121e5bf28a2dea55a1bfedfb6d93b726e9cade32da1c600bf58893dfd3dab4141bc2d550edbb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads