photon[.]apk | Triage™

Resubmissions

26/09/2026, 10:10

260926-l7htga1cpd7

25/09/2026, 17:49

260925-weeapaga437

Sharing

Copy URL Twitter E-mail

General

Target
photon.apk
Size 4.9MB
Sample260925-weeapaga43
SHA256 3d088eefc58b6e39fd16ecda3d4deb0cff0851b358f496aab4a58059f2319e8f
MD5 08fdfae01c6af8981c4b74f7662b9859
SHA1 9cf1e4a8c14c8d9f519b40061289f52cc38af27c
SHA512 213102ce25ae96489b88d38e569a387c2bc7c4ebbf7bdc139efbad0b7df09c0e39cba10c6f9965e6da95a53e6853c062cd2a5ca6ac142a86dbbfedf4f4cbfefa
SSDEEP 98304:9ioxIDK1gVAtz5R40Zy9bFlVH+Z6ogSElMxM1YPhFSZcI:9TxCVAtzEBbFlJSpA+I
TLSH
T18A362246EBE9E91EE9F3C33ACB35556A40468C628347D3878961723C18BB5D05E86FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
photon.apk
unpack001/data.sql

File Explorer

photon.apk

.apk 4.9MB
data.sql

.apk 4.6MB

photon.apk

SHA256 3d088eefc58b6e39fd16ecda3d4deb0cff0851b358f496aab4a58059f2319e8f
MD5 08fdfae01c6af8981c4b74f7662b9859
SHA1 9cf1e4a8c14c8d9f519b40061289f52cc38af27c
SHA512 213102ce25ae96489b88d38e569a387c2bc7c4ebbf7bdc139efbad0b7df09c0e39cba10c6f9965e6da95a53e6853c062cd2a5ca6ac142a86dbbfedf4f4cbfefa
SSDEEP 98304:9ioxIDK1gVAtz5R40Zy9bFlVH+Z6ogSElMxM1YPhFSZcI:9TxCVAtzEBbFlJSpA+I
TLSH
T18A362246EBE9E91EE9F3C33ACB35556A40468C628347D3878961723C18BB5D05E86FCC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ff2bdb0a81f0b37e215acc9ba7e99a034f27951005dd82c9885f01359d18fd3a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

rlru.lfwlrp.vnjjchl

data.sql

SHA256 3fbec1b9785dddabe0d04ec3c38dc56d89727b03dfd7c24f1bc29410c4b7dcc1
MD5 2c474e3b95fa67d8c467f44e15d90ac2
SHA1 e48246b5af533245d303759b9bd82e3548d9ec8f
SHA512 f15d456feb9fbd84128c799652de8cbd51a4d9bdd2586027a9a693c8c75e603262a1af3b93da94a22fc9cc520ff083905c8b63a6d3226e9c86f7cce021112381
SSDEEP 98304:9uiZc0DdbLI0Rc9GDXH/6N4emK+dyFo/KrrXMBBYxMqkZdW51:9uADd4tGDXxK+wUc2Y
TLSH
T1DE26DF8BFB44996BC0F753B68536572251478C268B43D7836958363C28BB6D07F8EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

5c23f302906f0b494c8ba23f93a4987ff52de0bf90080fec1aa38b75badc1b9b

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

opal.yesterday.photon

opal.yesterday.photon.Splasher

opal.yesterday.photon.HomeSIM

android.intent.action.MAIN

opal.yesterday.photon.HomeWallp

android.intent.action.MAIN

opal.yesterday.photon.HomeSmsung

android.intent.action.MAIN

opal.yesterday.photon.PlayS

android.intent.action.MAIN

opal.yesterday.photon.kangarooondwyisok

opal.yesterday.photon.northvypjugmfuwyosb

opal.yesterday.photon.meteortqndknd

opal.yesterday.photon.quarantinehjpjrsyabn

opal.yesterday.photon.kaleidoscopetvnpgylipyh

opal.yesterday.photon.sequoiadjkmhor

opal.yesterday.photon.nativecyeamjpkka

opal.yesterday.photon.speakit

opal.yesterday.photon.galleryynpgsxogyhsuml

opal.yesterday.photon.builderaolpsxuhzmu

opal.yesterday.photon.historyugtauyjxicv

opal.yesterday.photon.Toastit

opal.yesterday.photon.undergroundxkelpghznolrh

opal.yesterday.photon.vibrantmlqxgy

opal.yesterday.photon.Inputjusticeiizvbirq

opal.yesterday.photon.tropicalanrqxmxngw

opal.yesterday.photon.penguincwjvxkvhbotp

opal.yesterday.photon.dandelionkhmvkunmjwgofp

opal.yesterday.photon.jigsawwgrpoqysaxao

opal.yesterday.photon.butterflyqnieuhqbegtggvfa

opal.yesterday.photon.justiceiizvbirq

opal.yesterday.photon.highlandftaoeho

opal.yesterday.photon.pillowhpehevlgslmzj

opal.yesterday.photon.zipperzsqlbepeugfdjfj

opal.yesterday.photon.quicksilverztcdopzdactg

opal.yesterday.photon.CallBacker

opal.yesterday.photon.quintessentialqxoawdztfisrkq

opal.yesterday.photon.alarme

AppAlarm

opal.yesterday.photon.inletidocnccxn

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

opal.yesterday.photon.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

photon.apk

Permissions

android.permission.INTERNET

android.permission.GET_PACKAGE_SIZE

android.permission.POST_NOTIFICATIONS

rlru.lfwlrp.vnjjchl.permission.PROCESS

rlru.lfwlrp.vnjjchl.permission

android.permission.QUERY_ALL_PACKAGES

android.permission.INSTALL_PACKAGES

android.permission.REQUEST_INSTALL_PACKAGES

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

photon.apk

File Signature issue

rlru.lfwlrp.vnjjchl.PopupActivity

rlru.lfwlrp.vnjjchl.updateActivity

rlru.lfwlrp.vnjjchl.splash

rlru.lfwlrp.vnjjchl.Requestinstall

rlru.lfwlrp.vnjjchl.initiate

rlru.lfwlrp.vnjjchl.victoryusjgjvrsmp

rlru.lfwlrp.vnjjchl.bhqmgjpushjrsoul1

data.sql

File Signature issue

opal.yesterday.photon.Splasher

opal.yesterday.photon.HomeSIM

opal.yesterday.photon.HomeWallp

opal.yesterday.photon.HomeSmsung

opal.yesterday.photon.PlayS

opal.yesterday.photon.kangarooondwyisok

opal.yesterday.photon.northvypjugmfuwyosb

opal.yesterday.photon.meteortqndknd

opal.yesterday.photon.quarantinehjpjrsyabn

opal.yesterday.photon.kaleidoscopetvnpgylipyh

opal.yesterday.photon.sequoiadjkmhor

opal.yesterday.photon.nativecyeamjpkka

opal.yesterday.photon.speakit

opal.yesterday.photon.galleryynpgsxogyhsuml

opal.yesterday.photon.builderaolpsxuhzmu

opal.yesterday.photon.historyugtauyjxicv

opal.yesterday.photon.Toastit

opal.yesterday.photon.undergroundxkelpghznolrh

opal.yesterday.photon.vibrantmlqxgy

opal.yesterday.photon.Inputjusticeiizvbirq

opal.yesterday.photon.tropicalanrqxmxngw

opal.yesterday.photon.penguincwjvxkvhbotp

opal.yesterday.photon.dandelionkhmvkunmjwgofp

opal.yesterday.photon.jigsawwgrpoqysaxao

opal.yesterday.photon.butterflyqnieuhqbegtggvfa

opal.yesterday.photon.justiceiizvbirq

opal.yesterday.photon.highlandftaoeho

opal.yesterday.photon.pillowhpehevlgslmzj

opal.yesterday.photon.zipperzsqlbepeugfdjfj

opal.yesterday.photon.quicksilverztcdopzdactg

opal.yesterday.photon.CallBacker

opal.yesterday.photon.quintessentialqxoawdztfisrkq

opal.yesterday.photon.yearnmvobdzwcdymv

opal.yesterday.photon.elephantineucqdcipqfx

opal.yesterday.photon.everestseltubrdca

opal.yesterday.photon.undergroundgksdxzafpghqv

opal.yesterday.photon.yardagerxfvuedbczj

opal.yesterday.photon.victoryusjgjvrsmp

opal.yesterday.photon.logicalbrtbueyxos

opal.yesterday.photon.granitegqgnlkv

opal.yesterday.photon.fighternkiloqojmirv

opal.yesterday.photon.minserv

opal.yesterday.photon.riverivlteozqgwtzlm

opal.yesterday.photon.needlereyulnho

opal.yesterday.photon.Msss

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

opal.yesterday.photon.alarme

opal.yesterday.photon.inletidocnccxn

opal.yesterday.photon.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider