89f350332be1172fc2d64ac8ecd7fd15a09a2bd6e0ab6a7898a48fb3e5c9eac3

Analysis

max time kernel
141s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
22/12/2025, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photo.apk
Size 56KB
Sample251222-ect5patrev
SHA256 89f350332be1172fc2d64ac8ecd7fd15a09a2bd6e0ab6a7898a48fb3e5c9eac3
MD5 a4f09ccb185d73df1dec4a0b16bf6e2c
SHA1 c5c0953cb8dc15433b81f82ba7c8576301152d54
SHA512 cfe7cc37b5250e7acdce836bb9947eccb3cbad1fb425e86ce29d647af72345bce2a54c4f46e297a7043ef09e0ef8872afe2d9f0295f0f6a7edf3dd82e1a11089
SSDEEP 768:GOCFp/jmkdMCS43hoW6MpM55hkGzP87iPyYtm241AeUP2coEs5SE:GxFpqkKQKDhXk+PHt7qAeUPDst
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4243	pw.nrt.photo.google

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for write	content://media/external/images/media	pw.nrt.photo.google

pw.nrt.photo.google
1⤵
- Removes its main activity from the application launcher
- Reads the content of photos stored on the user's device.
PID:4243

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

htrewhw4whdsk7.jpg

Path /storage/emulated/0/DCIM/Camera/htrewhw4whdsk7.jpg
Size 5KB
SHA256 2d42bb186537f6852580531ed1596dd87335942b00d9ba97fbce36f0992135e5
MD5 82ab1482520fe41408c760c00a7c2714
SHA1 67f9906d9081c6e3ba8c5a6771cda796b4b93e7f
SHA512 f7d8ad3a38a3994567307d2288d56e12da1f2ba8406d3467afcc6457397c3bb0f24b8ae52b388834462f8016d1bbadc7a9eefdccebdb5f1ba04e3f40a19559dd
SSDEEP 96:d31OudC8AlmrxLlEdW2L2pZqw+xN5EystD3I/l/XNCyP0u3sCtzT8+4T7sfd:1MudC8u35fNvz/l/oyPb3TF8md
MD5 SHA1 SHA512 SSDEEP

Submit Download