e3ee0ccfb01e2effd49feddb252781baa2a05f8360d5cf949d09e3add1e73e4d

Analysis

max time kernel
146s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
10/04/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3ee0ccfb01e2effd49feddb252781baa2a05f8360d5cf949d09e3add1e73e4d.apk
Size

233KB
MD5

768475259b618607dcbf27a8f9fcfb9b
SHA1

baefbb0a1cac7835ea82a2e2a8f9702a6bda9f98
SHA256

e3ee0ccfb01e2effd49feddb252781baa2a05f8360d5cf949d09e3add1e73e4d
SHA512

e05e6d690ab3d568875559d9672a23f5e27441666d63df206cfe4300b50f6f3ce867c9b2769d60b31e59c0dc9566d7f23218f0c0f7f6228d0c0da5b3e56b9927
SSDEEP

6144:Y2g7dLU3wvjlECEK+277zVzIqJa+oqW6B:YXBt2HKvZIcaEWk

Score

8^/10

collection discovery evasion privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4420	com.photo.android.p

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.photo.android.p

Tries to add a device administrator. 1 TTPs 1 IoCs

privilege_escalation

Device Administrator Permissions

T1626.001

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.photo.android.p

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.photo.android.p

com.photo.android.p
1⤵
- Removes its main activity from the application launcher
- Requests cell location
- Tries to add a device administrator.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4420

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.photo.android.p/databases/dynamicamapfile.db

Filesize
20KB

MD5
4fa65216d7c7a0d708f0fc39947bc574

SHA1
df4d662c7336532c40ab966647bdfb2b74d8a0f0

SHA256
90efb1b89a9732f3da0cbfc20437ceb7a03e6607cbdb3eed1ddb8521e28c50c0

SHA512
9f38d1fb651f61a8b7c95460c0a6a55b7e0d60523c680f7f11d1fd8887078d6694ae5d68c2cd1207a86b8e7e8aeedf8117a6cea47d1fc38719be522be062063c

Download Submit
/data/user/0/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
512B

MD5
e64c516b82c8cfb28cb99d398f909b8a

SHA1
63cba63fad5d3956861d5b926075cddd413f3c34

SHA256
077ee68a98cd98daf7284125dffb37c3baf04489ae9bb37e594afe10e775b042

SHA512
0f1181e435f7921324cf5323e70471ecb592450c94f0dbff3d9767e605804a9e19ebfbcea26bfc4fd1ce9c13a303def9a576a8fb6118dbdff074c7e981e345fc

Download Submit
/data/user/0/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
b238707453324b81725dd06b5438c269

SHA1
fb51e4e69f7bd59b0795f4560946cfab3ed1fe2c

SHA256
d832ef13a818ef1202988bcbad9a79ab7968d2b816c46e4b47d53424607c3480

SHA512
789ac28b045ccad90fe805ecb3e34d439662a8e67b7929afcf4a60a537c5ae6f4d0040c8713645b4ec88935a987eed5221322244bfad9c35f3bbaaa680305ad3

Download Submit
/data/user/0/com.photo.android.p/databases/dynamicamapfile.db-journal

Filesize
8KB

MD5
48d72142215eff60db42f5fcfe14bcec

SHA1
017cb41638d2b2324ef65f6e2c1df19c5399b3eb

SHA256
04c7bd9fbc7df0eed8ad0a74d6b2dec9dd95291585750b4b1b1714831b694bf5

SHA512
cd2f4a9df0ea7a974a382cb5b7d742ea091a87ba3f470a6dbf2e4895f59a6ec07daa9b5ec7de1bd1d4cad34c72beb174416ec7d4b55e4a1f421c14fef628898d

Download Submit
/data/user/0/com.photo.android.p/databases/hmdb

Filesize
12KB

MD5
171aedf968e17a2744d2585715606cb9

SHA1
bbeddeb3b89fcf809619c35b4a318a80e7d5b029

SHA256
d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e

SHA512
78a0f517ee3d21c153dda6dbfec4187ebaee9d520d7b1b63f358bcb125d08aea53f26943907a56fdeba40161d9fc7e4fd63f9ae3154dd2ad887ba0162738285b

Download Submit
/data/user/0/com.photo.android.p/databases/hmdb-journal

Filesize
512B

MD5
c572ebc96b4d483ab0bb2d474e00d768

SHA1
e24e7e1eb0416d0cf92f268f80aa22524661e2bd

SHA256
883b83f80972c5c7d3fc446bd639a56a9e80588b3c624631de9f635c76b57640

SHA512
a82ff93ab8b345fd96f9b7225a8d37d0167f1fb94e667a24b9376f0be8d9433f1740e0eed549b8e12ec5716e623097e2102bdf3ba4d923b35485f032c0f2c49d

Download Submit
/data/user/0/com.photo.android.p/databases/hmdb-journal

Filesize
8KB

MD5
e1b21e92b2e596d4900b07ceb3b99359

SHA1
cda17edb82b6e19c808b4660e921dec63dd1ba8f

SHA256
0f86ca56a081b94362d34a21d2ff3f05a40ee57c5b88b378e2033944afb74dd0

SHA512
bc804f16c82fdffed42a5a67ec5bbc443b17ae615dec20c7a2f27ebf150834d55a65cacb6ac6fbb630e15db68512ca96b483491d842fe15462fd3fbd575a68e3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads