triada | 6dcd7ff6314ea4e516e2d30d7069be53447bf64f05c3bf688867a310561ab1f6

Analysis

max time kernel
4s
max time network
314s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
17-04-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GBWA 16.20 SamMods.apk
Size

97.0MB
MD5

12aa3280b4ce5d1b34212eb9b9f29abd
SHA1

886c180c861aef699ebd6be49f220389b389d49a
SHA256

6dcd7ff6314ea4e516e2d30d7069be53447bf64f05c3bf688867a310561ab1f6
SHA512

801f9f4abc5b760099da3936d5d805024f65ed3484d019e1f6ecb10d802729878966e11963024e04eb5fcfe4bcdc84d35eb4cc098ce4d2b142176acdfc2ecfac
SSDEEP

1572864:xpOjmryc1oFAOLAjIo0dVZPapJHhbozN986aPJHj7OCBjF:xpOjmO32R0dTQJoRiJHjq+jF

Score

10^/10

triada banker evasion infostealer trojan

Malware Config

Signatures

Android Triada payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_triada
behavioral1/files/fstream-1.dat	family_triada

Triada
Triada is an Android banking trojan first seen in 2016.
trojan infostealer banker triada

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4444	com.gbwhatsapp
/system_ext/framework/androidx.window.sidecar.jar	4444	com.gbwhatsapp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gbwhatsapp

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Requests dangerous framework permissions 24 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to advertise and connect to nearby devices via Wi-Fi.	android.permission.NEARBY_WIFI_DEVICES
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

com.gbwhatsapp
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4444

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gbwhatsapp/origin.apk

Filesize
76.1MB

MD5
243a705993221c7b739e8573d903f8e8

SHA1
b2a49e0c713954aa533b6d643edeae7f1dd0a9ac

SHA256
5b6380ea8a1e902174a03920c2876219efe7b69615dbd5d357ee0ed26889c734

SHA512
c4c8a0d5a3a4746882d01994e853d08797d62796106b603f2e939dcc1cc240a8bf17f4d871856f05f924d794fe911c0956eff592eeb9b8d2c487931fd65face7

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit