triada | hxxps://apkpure[.]net/whatsapp-android/com[.]whatsapp/downloading

Analysis

max time kernel
1814s
max time network
1834s
platform
android_x64
resource
android-x64-arm64-20240624-uk
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-uklocale:uk-uaos:android-11-x64system
submitted
21/08/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://apkpure.net/whatsapp-android/com.whatsapp/downloading

Score

10^/10

triada banker infostealer trojan

Malware Config

Signatures

Android Triada payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_triada

Triada
Triada is an Android banking trojan first seen in 2016.
trojan infostealer banker triada

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4470

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
682KB

MD5
6e76a90e58f9db68b6730160a473ddd0

SHA1
416c2afc9d60507a27ba82a66cb2bf7177bf8d24

SHA256
97d526befb7cab5320a7a28420fc4ba354e4d39cdff803f2e32edb7c5a47b557

SHA512
e16946d66b3c3c0e98e587b1b0a1a74211d3ba398a44547cc175dbf46554af4aec57f2a656cead69a86e5bd3def7ea2384b95334a5273e520b51da4dbe5832f2

Download Submit
/storage/emulated/0/Download/.pending-1724883002-WhatsApp Messenger_2.24.17.72_APKPure.apk

Filesize
96.9MB

MD5
37471dc70a41ab2575fd026c844dc94f

SHA1
4caf0bd61436ec375d5a4e82c13d1cb312b35cc1

SHA256
49ded6a9f54e3c3780a938ba72b9015879b3351d8fdf51a435a928f2ac7d125d

SHA512
e5d511013b1331ab33be364f4441b214d319326d00c7d700711a47336da6a1e8331669d22335a65552b498f6626624568fffbf4ef84e12f9bfe7467f20e4ac13

Download Submit
/storage/emulated/0/Download/.pending-1724883002-WhatsApp Messenger_2.24.17.72_APKPure.apk (deleted)

Filesize
559KB

MD5
4158b2535783d5963a7bb3d7c6451916

SHA1
2ce9477a32d13db737f8ff5e5b122102f26a6a49

SHA256
950de87419795b701de0e7819c1c3ed73c398a2666391a5ae78011ada066ea16

SHA512
1761d11dadea30e25d49e0bc54662b07c3a3f140747acc7ce472103f9e2a53b9adce66f09a50a84acc450ecb0af2cbae6962662d0a8596f0a1b9b983d293bc8d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads