ed3aa8e58d65c81df2f18e970456225b7c2b78e4add4dea556298a915b8fef1a | Triage

Analysis

max time kernel
13s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 14:48

Sharing

Report Analysis Logs

General

Target

ed3aa8e58d65c81df2f18e970456225b7c2b78e4add4dea556298a915b8fef1a.apk
Size

346KB
MD5

cf3ed93ddff7bc0b1fe401c14f2ecb91
SHA1

c729efaae21b9404b527b9cdd0b32eb3c224cf71
SHA256

ed3aa8e58d65c81df2f18e970456225b7c2b78e4add4dea556298a915b8fef1a
SHA512

e6db9ef58ce0b4c945dd805fee4a0e796c631908ccb4c5f440e81be99a92fe052c3e134956d98d0c1394e3d8ccd1ea7c976d0b1e8a472139221e09d172ac4ab5
SSDEEP

6144:jV+AXP1tBNYzDGH/Fzez5rO+X/JzXPRYILk2q3wXqZ0IiSPqDBwBctsIvU9Ej:xBH/FzU5i+X/ZBLk2DXqCaqDBsoXUM

Score

8^/10

evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4473	com.photo.android

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android

com.photo.android
1⤵
- Removes its main activity from the application launcher
- Tries to add a device administrator.
PID:4473
- su
  2⤵
  PID:4504

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads