wipelock | hxxps://web[.]archive[.]org/web/20230706214529/hxxps://download1587[.]mediafire[.]com/t1vdad3xufngg6CCX1k5jtiFJ0YYnHArLuX2ldpUW45Y7C5_ICaaMoj15-uYrQ6IH4D6uZD0Xn-dcHnvDAXCw1fpmTc_0gQtEgldscAvESOiKjQXCpk1VPUISW0N9EJwVOMwZfG74yKr06krisXQH9u4s95Hp7LFqY-oMYQYAG2yBcY/12o45hf43lvv6az/fnaf2+aptoide[.]apk

Analysis

max time kernel
1808s
max time network
1824s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
11-08-2024 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://web.archive.org/web/20230706214529/https://download1587.mediafire.com/t1vdad3xufngg6CCX1k5jtiFJ0YYnHArLuX2ldpUW45Y7C5_ICaaMoj15-uYrQ6IH4D6uZD0Xn-dcHnvDAXCw1fpmTc_0gQtEgldscAvESOiKjQXCpk1VPUISW0N9EJwVOMwZfG74yKr06krisXQH9u4s95Hp7LFqY-oMYQYAG2yBcY/12o45hf43lvv6az/fnaf2+aptoide.apk

Score

10^/10

wipelock infostealer trojan

Malware Config

Signatures

Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Wipelock Android payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-5.dat	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4324

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
2KB

MD5
f6d75ded37efb2a2a23f4de42cef1daf

SHA1
60db87cde8f053e4b5da4c4706e662b6051deb4e

SHA256
94ba72978ebb0f13b191515dadbabc84419db55bc9428cae0d4edfade316dce1

SHA512
2a2df3d45df2eab156e97d68e7152fe12a9f3940d539a2d075c7145aa2129c1dee2086d9f4b8192be4a2db1eb34684504feb8390246d109a258edba3b2dc5a78

Download Submit
/storage/emulated/0/Download/.pending-1723979204-fnaf2 aptoide.apk

Filesize
549KB

MD5
49f23d5486e36de84c7dfcfc607497b1

SHA1
e89e9e34d9fe5203a733059e81d786a99988cb69

SHA256
fc6738c227d62d70515c6487b95ca9438c599722fff4590bb2bae81fae5986ca

SHA512
6fdceb43a6446a2109658f2fb0b5072eb7bb09a0691547372286531ae95c34ef09b0b43d40e5a4432ae62eca80c16f5d011dfb044295001496dd12d49e99756a

Download Submit
/storage/emulated/0/Download/.pending-1723979204-fnaf2 aptoide.apk (deleted)

Filesize
525KB

MD5
dacb713500a17e6c3ca7e21e957b54a2

SHA1
f040b481adf978a2b707f0b50bbff50f7e5c4690

SHA256
b405bcaf8f8604d7ce24029a287bb1db48974c2326e022a60c3716f31ef1f506

SHA512
c9b1ec1b08e6aa4ba8d873dfa4023a00a05d13b33f4dbf71e37a3a3a7908fa27ada61c8a5e5aff7c32f29162862d3d88d1b363168cd2194844178647e73809f2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads