triada | 2de70ca737c1f4602517c555ddd54165432cf231ffc0e21fb2e23b9dd14e7fb4

Sharing

Copy URL

Twitter E-mail

General

Target

GBWhatsApp_2024.apk
Size

72.1MB
Sample

240621-mmcx6azeql
MD5

06b80586f3db28fd0886c68d327e6d6d
SHA1

5eb26f69caa5fc281eaba466ead6a968545eab4f
SHA256

2de70ca737c1f4602517c555ddd54165432cf231ffc0e21fb2e23b9dd14e7fb4
SHA512

026a690010bed12dcdcd0d90f9254e66dd581773df690f95fb2b946a9400eabc9958db665045360f2d947dc3ff78f1f7af42515b751cfe455ba90457f29f5a03
SSDEEP

1572864:J/2LZ1VbXhETM0kZlShysJPC2DLPwpJ08w:JaZLbRuk0TjH

Score

10^/10

Malware Config

Targets

- Target
  
  GBWhatsApp_2024.apk
- Size
  
  72.1MB
- MD5
  
  06b80586f3db28fd0886c68d327e6d6d
- SHA1
  
  5eb26f69caa5fc281eaba466ead6a968545eab4f
- SHA256
  
  2de70ca737c1f4602517c555ddd54165432cf231ffc0e21fb2e23b9dd14e7fb4
- SHA512
  
  026a690010bed12dcdcd0d90f9254e66dd581773df690f95fb2b946a9400eabc9958db665045360f2d947dc3ff78f1f7af42515b751cfe455ba90457f29f5a03
- SSDEEP
  
  1572864:J/2LZ1VbXhETM0kZlShysJPC2DLPwpJ08w:JaZLbRuk0TjH
Score

8^/10

discovery execution impact persistence upx evasion
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Acquires the wake lock
- Queries information about active data network
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral2 behavioral20 behavioral21 behavioral22 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Patched UPX-packed file

Loads dropped Dex/Jar

UPX packed file

Acquires the wake lock

Queries information about active data network

Reads information about phone network operator.

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22