e3ee0ccfb01e2effd49feddb252781baa2a05f8360d5cf949d09e3add1e73e4d

Analysis

max time kernel
144s
max time network
146s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
10/04/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3ee0ccfb01e2effd49feddb252781baa2a05f8360d5cf949d09e3add1e73e4d.apk
Size

233KB
MD5

768475259b618607dcbf27a8f9fcfb9b
SHA1

baefbb0a1cac7835ea82a2e2a8f9702a6bda9f98
SHA256

e3ee0ccfb01e2effd49feddb252781baa2a05f8360d5cf949d09e3add1e73e4d
SHA512

e05e6d690ab3d568875559d9672a23f5e27441666d63df206cfe4300b50f6f3ce867c9b2769d60b31e59c0dc9566d7f23218f0c0f7f6228d0c0da5b3e56b9927
SSDEEP

6144:Y2g7dLU3wvjlECEK+277zVzIqJa+oqW6B:YXBt2HKvZIcaEWk

Score

8^/10

collection discovery evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4285	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4285
- su
  2⤵
  PID:4353

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
d5950b4302984c62ae015c70f8359000

SHA1
44de2b51c2942afc6706cfd591bd17e0b22732a2

SHA256
b25855280d949ff775756116e72d78ac73561352dfa33866835ccd355d037f9d

SHA512
39c732e681ba5913a12d78056a128a2f7a2cf3b78f5735727e629b15bd5f498ea22ca1bee6bd0c7580c2443cc08e4416c454679bf52ca34fb91366f6374b334c

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
e1dcc90437d65f1fdbdbd469db4e5c6f

SHA1
2f1aa61ad4744b63cc69e6421e4e27c9f4faf022

SHA256
25b259bd7604e26146bf847020dffafd0b2db0a629fc3e477822f3fed37d8d0e

SHA512
1ef1d9b1a65f994a962799f9e34d9beedaa676d30d1b8107c105eaed557f666bc682cd7eb7826a1aa479a3255076ea18c42ab386619d418b3296760db79eef2d

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.photo.android.p/databases/dynamicamapfile.db-wal

Filesize
32KB

MD5
55e0bbf0fd255aa91fde1ab24844bc07

SHA1
c7aed328cd0d90804cdfa8e982ccce24b35c3638

SHA256
f549f5d2df7272d6c2bac1c97bd2c094cb1e1f55a0de868b0c598d1203b87e09

SHA512
b80e762e9d1097c55bd228f20468760db0d3314ae228f5fb88c829f6c4b61b55a8f863223143891d99b05a8c289e44aeec835e5fe6da334cae355aa3d3865ff3

Download Submit
/data/data/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
3fe30614d7e0d11db870b4624f6c50e0

SHA1
053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

SHA256
67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

SHA512
c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

Download Submit
/data/data/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
d2d13c8123a15fdb3eca5aae2557b05f

SHA1
55825a446dd0e5f3aae34aff1d1f7ba6adf326ac

SHA256
910874c6fe4f90f0674e8f57d1861ff9631d61f19daac7d88f327df34d37d2c7

SHA512
03d2dbf5983b933a49334cf4feed3106cb0e11603b4751367accd791f7a343d33b3fa412f0e2fee6ee2df912280b4e397404733708612a62d311e0d48466df88

Download Submit
/data/data/com.photo.android.p/databases/hmdb-wal

Filesize
16KB

MD5
cd0480c8490f207d900c4696ea63234e

SHA1
c4fe24d170f01898493d10a600c48e9caa1bfa1f

SHA256
f554cdb52894c655604a455a46ced61fde7e3f8b67dcc1d0575c2672538ee2f6

SHA512
a528eba1aaa1822e1136c5abe82e77afcad663631dc2307e63d06258a857179de1fca5ebded5d0ffe1794b2b251777c8ec5f86f1532e08906ec2b4345d8bd87c

Download Submit
/storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712759895

Filesize
917B

MD5
4f28a069a2adafd241c0b9294255f318

SHA1
dfbab2e20b6755235f70d20bcbd1c8bae26ef10a

SHA256
1d8f1323888e9359c3efffa16f456191ff29ffe7e7aab0747d6c39dc47397920

SHA512
be6a9c9f44b0f4f9e86d4b5b7e3edacd70fa4406315e99250231995ddb51905db3b131cca8b7f6796612d666a408ccdc5a0132eb615fe8139e7369d72c6ceaff

Download Submit
/storage/emulated/0/Android/data/com.photo.android.p/files/carrierdata/1712759895

Filesize
2KB

MD5
fcbd74ecc27c5122f532a2fefaf55c66

SHA1
cc7112e6e94abc705f377b4615bb3ccba1b20f0d

SHA256
d07daddaa2189d37ae8aedf7406296233db72ec259ca0de319315c831c9f60ae

SHA512
6f74cf19edeaebec19742947a0a50cecbabfe4fc1ecadd6d1c919cf0e232de0db7ccfe3c1b6d8e1477908069afd4df9c5a3f8222d403cf4dea7b1535615c050b

Download Submit
/storage/emulated/0/Android/data/tmp/map.dat

Filesize
109B

MD5
ac7332501821ee06031ac744a00fcccc

SHA1
8428b20a4cfe2669e000038561ffd5393135dac0

SHA256
8a3613dd48056fbf5113990ef5b13220152b086483b285422c00a0edcff6ac49

SHA512
4473d9f4309359503529315de40f4e1cfe743a0bf291f353e618df20cf878150e81abcd442e422b7bf43d8caf75347c1ec18649c470c39843868795b84052fd3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads