Overview

overview

10

Static

static

10

FMWhatsApp_v9.98.apk

android-10-x64

FMWhatsApp_v9.98.apk

android-11-x64

7

FMWhatsApp_v9.98.apk

android-13-x64

7

FMWhatsApp_v9.98.apk

android-9-x86

8

Analysis

  • max time kernel
    159s
  • max time network
    305s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    12/02/2024, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FMWhatsApp_v9.98.apk
  • Size 76.2MB
  • Sample240212-ranw4sfd5x
  • SHA256 1a5aac2a6c5a1e625821a2260675248596839806758d253156fb1c1da56ae8b9
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
upx

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Acquires the wake lock 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes

  • com.fmwhatsapp
    1⤵
    • Acquires the wake lock
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4287

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        static.whatsapp.net.443
        • Path /data/data/com.fmwhatsapp/cache/SSLSessionCache/static.whatsapp.net.443
        • Size 5KB
        • SHA256 c03c7b7590f932e57badafae38aed713dd23626bae10104bd81a5b0c65c3bb27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        static.whatsapp.net.443
        • Path /data/data/com.fmwhatsapp/cache/SSLSessionCache/static.whatsapp.net.443
        • Size 5KB
        • SHA256 7b035f22b9615ccdcb525b66343da21d3c7a46506f58c559f7549892f3ff73a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00004LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00004LightWallpaper.jpg
        • Size 18KB
        • SHA256 f56b072e6ad0fcce9bfc1672813e26c61633173b855a77d1be7306e85adeb1bb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00005LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00005LightWallpaper.jpg
        • Size 2KB
        • SHA256 05d19d5dd0b63e35b62586b17ab4981e147ac96a52c9fba6990ff80dbc7d5cd4
        • MD5 SHA1 SHA512
        Submit Download

        00008LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00008LightWallpaper.jpg
        • Size 16KB
        • SHA256 902ffcd2796f7c0e2b9ddb8c329e9069c40170244e3186fd32211ae76168ba22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00011LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00011LightWallpaper.jpg
        • Size 12KB
        • SHA256 48d16b254531c57d75e80dcbaa2e1d679b29852e3fa3ec2b2f63b2ba816f817b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00017LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00017LightWallpaper.jpg
        • Size 31KB
        • SHA256 0bb186e8302fa0cd263fef0c554931b274b94976e364049c7917befd0adab971
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00020LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00020LightWallpaper.jpg
        • Size 17KB
        • SHA256 c0007b387df66d1e2b2c8893c94cb0883f2bd40b3dc56ef014a13eae6bc5fa61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00025LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00025LightWallpaper.jpg
        • Size 11KB
        • SHA256 00d9118ef010fefe005bef10ee98608674e8b940e19bbe8a255b37856e30eb05
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00028LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00028LightWallpaper.jpg
        • Size 9KB
        • SHA256 8507e48d67270c95797a4d6fa9f244f773629e8e37477c3c72d0135d4410adb3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00029LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00029LightWallpaper.jpg
        • Size 18KB
        • SHA256 0261ad4bbb5d653eb29509e333fab2f4f34e9fe71627e6a868d2d9bb1b73128b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        00030LightWallpaper.jpg
        • Path /data/data/com.fmwhatsapp/cache/downloadable/wallpaper_tmp/thumbnails/light/00030LightWallpaper.jpg
        • Size 9KB
        • SHA256 0277f81cd8974ab3839da8c910b1ea943444e9a4f8b6c023515832fc225d5fb1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        downloading-1360502956168006867.tmp
        • Path /data/data/com.fmwhatsapp/cache/downloading-1360502956168006867.tmp
        • Size 73KB
        • SHA256 5a89ab27be17e625c094159b40f68b6714ea3cc3cf8de1fd84ef584b725cb8ba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BTOR.DB
        • Path /data/data/com.fmwhatsapp/databases/BTOR.DB
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512
        Submit Download

        BTOR.DB-journal
        • Path /data/data/com.fmwhatsapp/databases/BTOR.DB-journal
        • Size 512B
        • SHA256 f88d5e12cbbcde7d7c04e23a1371edcfaaaffbc4e9b71c36bb0694618399e1de
        • MD5 SHA1 SHA512
        Submit Download

        BTOR.DB-shm
        • Path /data/data/com.fmwhatsapp/databases/BTOR.DB-shm
        • Size 28KB
        • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BTOR.DB-wal
        • Path /data/data/com.fmwhatsapp/databases/BTOR.DB-wal
        • Size 32KB
        • SHA256 76b186516342b1caf259318e6a3ac83e1fb056782290b4493f82a9d032a272f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EHS.DB-journal
        • Path /data/data/com.fmwhatsapp/databases/EHS.DB-journal
        • Size 512B
        • SHA256 998a7fb2e596e3bc576988fea9f71855f132c80ae5647705619c6afceab35ba2
        • MD5 SHA1 SHA512
        Submit Download

        EHS.DB-wal
        • Path /data/data/com.fmwhatsapp/databases/EHS.DB-wal
        • Size 36KB
        • SHA256 b91640062bfe4349c3ab34aff1efd658ef1e75ee8406571f6c84eed8b7548103
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _jobqueue-FMWhatsAppJobManager-journal
        • Path /data/data/com.fmwhatsapp/databases/_jobqueue-FMWhatsAppJobManager-journal
        • Size 512B
        • SHA256 06ff75426603e0139a8b761b7071b72c1ffe2606ad7ebb8335b50e8b536a3047
        • MD5 SHA1 SHA512
        Submit Download

        _jobqueue-FMWhatsAppJobManager-wal
        • Path /data/data/com.fmwhatsapp/databases/_jobqueue-FMWhatsAppJobManager-wal
        • Size 28KB
        • SHA256 85932285058afb75f287c57074c0fb52860d511394577db5d9b3f1a77ecd8be6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        axolotl.db-journal
        • Path /data/data/com.fmwhatsapp/databases/axolotl.db-journal
        • Size 512B
        • SHA256 8cf525fe4c06404cdab81e43274cbdaaf2dcacc6a2b8187e50cbdb2026137254
        • MD5 SHA1 SHA512
        Submit Download

        axolotl.db-wal
        • Path /data/data/com.fmwhatsapp/databases/axolotl.db-wal
        • Size 197KB
        • SHA256 0c176a929dc0896c5c605a79a6a94a8273d4a3d92dd002af2738cabef065e102
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        axolotl.db-wal
        • Path /data/data/com.fmwhatsapp/databases/axolotl.db-wal
        • Size 16KB
        • SHA256 b122af6af801f4819b79e53b8f0e3f3c7f950e26423cf320a7b852306755a4f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        stickers.db-journal
        • Path /data/data/com.fmwhatsapp/databases/stickers.db-journal
        • Size 512B
        • SHA256 9f1af00a42a7f6e6786723bd05b24b5464ada2f100b75655a4e900815f31182f
        • MD5 SHA1 SHA512
        Submit Download

        stickers.db-wal
        • Path /data/data/com.fmwhatsapp/databases/stickers.db-wal
        • Size 16KB
        • SHA256 b80c3aa5cf0bfb0205519eef34cc68ef393abd430d6a305681b5772b8325baec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        stickers.db-wal
        • Path /data/data/com.fmwhatsapp/databases/stickers.db-wal
        • Size 136KB
        • SHA256 d60f1136e43a302ad0ca4ac11361a074215e0cb6628194dd7b0063085ddd2e06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sync.db-journal
        • Path /data/data/com.fmwhatsapp/databases/sync.db-journal
        • Size 512B
        • SHA256 c7639bd2fe153ed4f217551664d49c9ee75443795e5282e30f59752d570b12ad
        • MD5 SHA1 SHA512
        Submit Download

        sync.db-wal
        • Path /data/data/com.fmwhatsapp/databases/sync.db-wal
        • Size 16KB
        • SHA256 053daeba68bf693721c4b509c0d7b83e7f547905f9a481d9391e3f7198e4a34e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wa.db-journal
        • Path /data/data/com.fmwhatsapp/databases/wa.db-journal
        • Size 512B
        • SHA256 7ef669f4a56001d374cc60f15ffa6e5896a4a55d8953c88ebec12a2a305f0e75
        • MD5 SHA1 SHA512
        Submit Download

        wa.db-wal
        • Path /data/data/com.fmwhatsapp/databases/wa.db-wal
        • Size 16KB
        • SHA256 5c42c675f8fd4d41541ab3db7fabc7a137a0f0371b8cefa37a67e9d08140ff22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        c8c4ce97-40fe-4ca4-8e24-5637aadbee13
        • Path /data/data/com.fmwhatsapp/files/.trash/5a7940ee-885e-4a52-815d-0762bc6368cb/c8c4ce97-40fe-4ca4-8e24-5637aadbee13
        • Size 67B
        • SHA256 afff045ccff4a25dc9ed283acb206e37fbcdc6afd5adacc86c645d432e032a21
        • MD5 SHA1 SHA512
        Submit Download

        fe34efa1-2b25-4932-abeb-6ad1fef98186
        • Path /data/data/com.fmwhatsapp/files/.trash/5a7940ee-885e-4a52-815d-0762bc6368cb/fe34efa1-2b25-4932-abeb-6ad1fef98186
        • Size 526B
        • SHA256 62802cd5039ff363156f7d4dd4d7360d095090a6331131f018abba016b6e1aa6
        • MD5 SHA1 SHA512
        Submit Download

        whatsapp.log
        • Path /data/data/com.fmwhatsapp/files/Logs/whatsapp.log
        • Size 187B
        • SHA256 2e10bb683fdac5a05b398262d0d74e7aa083af291b676b65f83efcd12d2f533c
        • MD5 SHA1 SHA512
        Submit Download

        libaom.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libaom.so
        • Size 1.3MB
        • SHA256 0e277b375010e80b36a7efcae0b9344e939a11fb0a8c2ec3ce910fcc654abfd3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libc++_shared.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libc++_shared.so
        • Size 595KB
        • SHA256 b216ebebe5303bbd9787bc7b771b67ed56beaf337b783b65b19eb36041f99571
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcurve25519.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libcurve25519.so
        • Size 128KB
        • SHA256 3f87ea915f7e177074daa255a9e5fe8797cd9407140f5efaba164e8a7778ab7a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libfb.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libfb.so
        • Size 57KB
        • SHA256 9326bc74ec9bdae620b60f2863724479b48fa86a4d120f566ad6c2557eb3386c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libfbjni.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libfbjni.so
        • Size 122KB
        • SHA256 f7bf47d156cd1c62e8dfc1bb364b40e6c313c0ad74fbcd2f2cd83da78652fc27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libflexlayout.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libflexlayout.so
        • Size 30KB
        • SHA256 e0a775c905207cb2191ce1d052687a7eae05e3b9ecf4c2306fb69fb4050bb7a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libgifimage.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libgifimage.so
        • Size 26KB
        • SHA256 3c2390143f9aefc97930a284a685e4852e41d916af37bee29047671d10184311
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libmagi.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libmagi.so
        • Size 981KB
        • SHA256 0cd3947854d4ce45fe1380b2d8ec8129c693fb51cbba31e5764b9caeee3dcf8e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libprofilo.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libprofilo.so
        • Size 70KB
        • SHA256 03787b8cf4aa571cc39039ac738ea60ade4f600a3816d50cae2ee64176d56305
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libprofilo_atrace.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libprofilo_atrace.so
        • Size 20KB
        • SHA256 21d9e7a1a192c10d89a110e0950b121b931649b7e676d02864eb6eaa99b2f057
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libprofilo_build.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libprofilo_build.so
        • Size 3KB
        • SHA256 fee251137ea0db03b6e7524ed194088c47910e4b05b05897371df4cc5cfded1a
        • MD5 SHA1 SHA512
        Submit Download

        libprofilo_fb.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libprofilo_fb.so
        • Size 2KB
        • SHA256 659d075164196d5001d5e05f46a2b6d720fd00c6a2a010d43d290d2251340388
        • MD5 SHA1 SHA512
        Submit Download

        libstatic-webp.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libstatic-webp.so
        • Size 316KB
        • SHA256 4fd27128e1e6ea8c82357c6cc213e2d1b87d6e0e15a635b35e8ac5a496514ce6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libvlc.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libvlc.so
        • Size 3KB
        • SHA256 0d87625993ef963e9bebf8f21f22525807d48dc26b3195fe94bedfe877f376e7
        • MD5 SHA1 SHA512
        Submit Download

        libwhatsapp.so
        • Path /data/data/com.fmwhatsapp/files/decompressed/libs.spk.zst/libwhatsapp.so
        • Size 6.2MB
        • SHA256 4ef4c861d1a142bd09437e468ccf61492222f65349f4ba22cff00cbd2298201d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.fmwhatsapp/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 797bcf5f53882a81035891624fb768dc08680595b15d98541bf0e89f687c14b1
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.fmwhatsapp/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 f26457a930190de84b3400a9de99ca963fa8e0ad7275ce9333edad0fd8c75ce3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.fmwhatsapp/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 2d3c6dce37952b265619d42097b223cbb47e6a4a0869c665b512d31bd1126ecf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.fmwhatsapp/no_backup/androidx.work.workdb-wal
        • Size 169KB
        • SHA256 ba0df39303426e6ea190dbf840fc55a6ab4c22cde041504c9cc34289e4ca9c18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        com.google.InstanceId.properties
        • Path /data/data/com.fmwhatsapp/no_backup/com.google.InstanceId.properties
        • Size 63B
        • SHA256 601ef87cafc3e5382b7cc4a4dd5f4e7e373cf82762301db4e16b121675dd86a8
        • MD5 SHA1 SHA512
        Submit Download