Analysis
- max time kernel
149s - max time network
157s - platform
android_x86 - resource
android-x86-arm-20240221-en - resource tags
- submitted
01/04/2024, 10:46
General
- Target FMWA9.98@FouadMODS (1).apk
- Size 76.1MB
- Sample240401-mt5azscd5x
- SHA256 3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316
Malware Config
Signatures
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Acquires the wake lock 1 IoCs
- Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.fmwhatsapp1⤵
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
static.whatsapp.net.443
static.whatsapp.net.443
00001DarkWallpaper.jpg
00002DarkWallpaper.jpg
00003DarkWallpaper.jpg
00004DarkWallpaper.jpg
00005DarkWallpaper.jpg
00006DarkWallpaper.jpg
00007DarkWallpaper.jpg
00008DarkWallpaper.jpg
00009DarkWallpaper.jpg
00010DarkWallpaper.jpg
00011DarkWallpaper.jpg
00012DarkWallpaper.jpg
00013DarkWallpaper.jpg
00014DarkWallpaper.jpg
00015DarkWallpaper.jpg
00016DarkWallpaper.jpg
00017DarkWallpaper.jpg
00018DarkWallpaper.jpg
00019DarkWallpaper.jpg
00020DarkWallpaper.jpg
00021DarkWallpaper.jpg
00022DarkWallpaper.jpg
00023DarkWallpaper.jpg
00024DarkWallpaper.jpg
00025DarkWallpaper.jpg
00026DarkWallpaper.jpg
00027DarkWallpaper.jpg
00028DarkWallpaper.jpg
00029DarkWallpaper.jpg
00001LightWallpaper.jpg
00002LightWallpaper.jpg
00003LightWallpaper.jpg
00004LightWallpaper.jpg
00005LightWallpaper.jpg
00006LightWallpaper.jpg
00007LightWallpaper.jpg
00008LightWallpaper.jpg
00009LightWallpaper.jpg
00010LightWallpaper.jpg
00011LightWallpaper.jpg
00012LightWallpaper.jpg
00013LightWallpaper.jpg
00014LightWallpaper.jpg
00015LightWallpaper.jpg
00016LightWallpaper.jpg
00017LightWallpaper.jpg
00018LightWallpaper.jpg
00019LightWallpaper.jpg
00020LightWallpaper.jpg
00021LightWallpaper.jpg
00022LightWallpaper.jpg
00023LightWallpaper.jpg
00024LightWallpaper.jpg
00025LightWallpaper.jpg
00026LightWallpaper.jpg
00027LightWallpaper.jpg
00028LightWallpaper.jpg
00029LightWallpaper.jpg
00030LightWallpaper.jpg
00031LightWallpaper.jpg
00032LightWallpaper.jpg
downloading-319661221115445313.tmp
BTOR.DB
BTOR.DB-journal
BTOR.DB-shm
BTOR.DB-wal
EHS.DB-journal
EHS.DB-wal
_jobqueue-FMWhatsAppJobManager-journal
_jobqueue-FMWhatsAppJobManager-wal
axolotl.db
axolotl.db-journal
axolotl.db-wal
axolotl.db-wal
chatsettings.db-journal
chatsettings.db-wal
chatsettings.db-wal
stickers.db-journal
stickers.db-wal
stickers.db-wal
sync.db-journal
sync.db-wal
sync.db-wal
wa.db-journal
wa.db-wal
wa.db-wal
e3d8e37c-8750-4a8b-a5dc-6bf8a89c80b1
e71e9b91-9e75-4f99-b70c-54d9cc9c2705
whatsapp.log
.superpack_version
libaom.so
libar-bundle1.so
libar-bundle2.so
libar-bundle3.so
libar-bundle4.so
libar-bundle5.so
libc++_shared.so
libcurve25519.so
libfb.so
libfbjni.so
libfbsofterror.so
libflexlayout.so
libgifimage.so
libglog.so
libgraphicsengine-arengineservices-whatsappservicehost-native.so
libmagi.so
libminscompiler-jni.so
libprofilo.so
libprofilo_atrace.so
libprofilo_build.so
libprofilo_counters.so
libprofilo_fb.so
libprofilo_fmt.so
libprofilo_jmulti_buffer_logger.so
libprofilo_linker.so
libprofilo_logger.so
libprofilo_mmapbuf.so
libprofilo_mmapbuf_buffer.so
libprofilo_mmapbuf_buffer_jni.so
libprofilo_multi_buffer_logger.so
libprofilo_plthooks.so
libprofilo_sigmux.so
libprofilo_stacktrace.so
libprofilo_systemcounters.so
libprofilo_threadmetadata.so
libprofilo_util.so
libprofiloextapi.so
libpytorch.so
libstatic-webp.so
libtorch-code-gen.so
libvlc.so
libwhatsapp.so
strings_en.pack
extracted_pack_file.pack.tmp
wam.wam
wamprivatestats.wam
wamrealtime.wam
dso_deps
dso_manifest
dso_state
dso_state
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
com.google.InstanceId.properties