329ccadb1f5a9027f7c85061cb5d2137343749f585120ce339e437ef2ccd18f9

Resubmissions

15-09-2024 13:05

240915-qbk16swaqk 10

11-08-2024 03:45

240811-ebk6dstdrq 6

10-08-2024 18:57

240810-xlxahssgrj 10

Analysis

max time kernel
2s
max time network
79s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
10-08-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

whatsapp_Plus_17.85_whatsapplus.org.apk
Size

114.8MB
MD5

56ccacc70ccc328698edc296e183e9c8
SHA1

5c9bfdd00ae326c766611ed26770a1fd4acff73a
SHA256

329ccadb1f5a9027f7c85061cb5d2137343749f585120ce339e437ef2ccd18f9
SHA512

accbf2510ff0eb3dada21a001c5fc1eb8f66e9583ee270745eecfc9262d6adf120de38ec6feecd1ac188cdcb52babf8d54803ab9464729585d16f1f49a1666b6
SSDEEP

1572864:df3YFq69wcVm6+i5AEhKr+4QDuUaJRKfyMuK0aPKIUsqGM7UgolqKWG40rAIZBS/:dvYFHnKbEQWsGXuK0EHMJGWp0fZMd1

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.aerowtsapp

ioc pid process

/system_ext/framework/androidx.window.sidecar.jar 4604 com.aerowtsapp
/system_ext/framework/androidx.window.sidecar.jar 4604 com.aerowtsapp

ioc	pid	process
/system_ext/framework/androidx.window.sidecar.jar	4604	com.aerowtsapp
/system_ext/framework/androidx.window.sidecar.jar	4604	com.aerowtsapp

com.aerowtsapp
1⤵
- Loads dropped Dex/Jar
PID:4604

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.aerowtsapp/.cache/classes.dve

Filesize
24B

MD5
ff0af6ad154acbe0870ae9064045df23

SHA1
97fffd43b0eb9c67c5398534c4f65a19ec718351

SHA256
29d44b56ab727bd258588ab98e760c47916646305b6f54d5551e84b3b86f5704

SHA512
7e6b88f7e9817a0e3163ce34a67937e42655f0a0f10bd35e449e936344ab602241e75082817c60bc8dfe11111cce4bedfa2db85152409256ee5187bc41ef884a

Download Submit
/data/user/0/com.aerowtsapp/.cache/classes.jar

Filesize
24.9MB

MD5
b9a5fcd22af6f0d910b5a03203fa3686

SHA1
857dfad7a6c17110879e86074ec61b5f2d68e73a

SHA256
2e65eece7f19709d1b5462e3fb2b364e55193096e9b092932d32771405dcd507

SHA512
484ece1672b3f3ea4ae293b337b0cfdfe0f8393977b25f4b7084f46c28f47d71a6d70dd66b239ad9be5889fe43de49280583ce8997d8ed6f8a39f0d29dac2eb3

Download Submit
/data/user/0/com.aerowtsapp/.cache/libSecShell32_x86.so

Filesize
1.3MB

MD5
c152b457d290c7d847a6b78d99e6e86c

SHA1
c9012f5e4232a261783d876433a840ce2f0af5c8

SHA256
26b7884ce133f917687bd528d2307bc221bb6f8d27fd1b3b0d4f1c462fc8eb33

SHA512
86176817a7fea6788921be494643a96dc0dbe77e2484c25e3a60f0f62fef84cc0f1c357b8d2199bd9ded5a208862f3daf089a802c46e6bca4393ad0a88f880b3

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit