Analysis
-
max time kernel
8s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
22-05-2024 12:03
Static task
static1
General
-
Target
waterfly-iii.apk
-
Size
10.4MB
-
MD5
906ebf16833ae1842eb03054e0bcc4b7
-
SHA1
b664030e47839afbc2a072e1900e2d34ad9a254c
-
SHA256
a80522dad5f1afe0f0dde3e954333f7a57746e134cc03bc9622f7d4cf7c73c2c
-
SHA512
a59c01ff8627954021fe7e6cedc9bdb45fb47b781cf038572e8c5158fc6031f0bb27bbada48f011581e59bebdffd1b604d24ee97f4ab9d80167b4f4b6fd79881
-
SSDEEP
196608:6O8IVBNRcCI2LdxVFeQxYgkFWTOHaYjnHSydflXeCbiP9VHqrRqbqzs:6OLpR8Kx2QqgwWTO6+nHSk9O1aR9s
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.dreautall.waterflyiiidescription ioc process File opened for read /proc/cpuinfo com.dreautall.waterflyiii -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.dreautall.waterflyiiiioc pid process /system_ext/framework/androidx.window.sidecar.jar 4601 com.dreautall.waterflyiii /system_ext/framework/androidx.window.sidecar.jar 4601 com.dreautall.waterflyiii -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.dreautall.waterflyiiidescription ioc process Framework API call javax.crypto.Cipher.doFinal com.dreautall.waterflyiii
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/system_ext/framework/androidx.window.sidecar.jarFilesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b