b55863753f676d99ddc897acb1a0e715ba18834d87299de9beac0eeb11847a2f

Analysis

max time kernel
3s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-09-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WhatsApp.apk
Size

96.9MB
MD5

3b07900d25e55d03f6a630858b24b0dc
SHA1

adc8b3102b577097dbf56c324d857b61a63464ca
SHA256

b55863753f676d99ddc897acb1a0e715ba18834d87299de9beac0eeb11847a2f
SHA512

8550ced79a62a5c7ae8b47db3b6e6e1db90133bbc971843e32115f461c329e0dcc05c9590974e4f308a51c45b70d0874c5f2ce81bbe0913df1528862e166e2aa
SSDEEP

3145728:FSSsHNvcyEuKAXBXq/Co0Lj8ip/l8PdR5kBGt:OpxXm0Lj8W6dowt

Score

6^/10

discovery

Malware Config

Signatures

Acquires the wake lock 1 IoCs

Processes:

com.whatsapp

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.whatsapp
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.whatsapp

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.whatsapp
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.whatsapp

description ioc process

File opened for read /proc/meminfo com.whatsapp

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.whatsapp

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.whatsapp

description	ioc	process
File opened for read	/proc/meminfo	com.whatsapp

com.whatsapp
1⤵
- Acquires the wake lock
- Queries information about active data network
- Checks memory information
PID:4288

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.whatsapp/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.whatsapp/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
3d17f73502180559c8f306c884e5586e

SHA1
d2ecf6fa681193c23b8e9d4e03307b214e76040b

SHA256
5c8eb072ec043e3ec1fdef05938a35d69d7ac0e4a374ced8d3dcb357f77a6dd4

SHA512
00f0ceeb883d89038e697d37be976c61d1f5f48e151e4e36072308e6793290f145bbfeea9bba05eb8ae3622694be443c6a6540c4550af9cf6f69d89e659a2184

Download Submit
/data/data/com.whatsapp/databases/com.google.android.datatransport.events-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.whatsapp/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
693c3a902512365627cd70ae94247771

SHA1
58782374b231e4f8f4a81c4db5cbd0f163acc1f0

SHA256
bee831af73c39932495c4160611b6f6d781f634b32cdafcb8d00443dc9191450

SHA512
fad7a2e095a774c7ebf3746e65544d568d85e8f47eb30c9bb6f5fc6206a1b8469ef0f999b02ec8a30addb2b5db1209f9521074dba72b97f54fe00c0091c4dd81

Download Submit
/data/data/com.whatsapp/files/Logs/whatsapp.log

Filesize
857B

MD5
bbef4eeb7249d3614cf011f83dc3fc85

SHA1
dfe8722297cfe233ec14d67de647a1cfc410644d

SHA256
d7a098f4966d27b660a00578152470dee2c2c8f10d46abd837ca069ccdbea382

SHA512
3758142234b0d66eec31f81a5cd3b5d4b837b68df1aad2047fee8b309a76c13d8ee0e0e447d869fc29a1be2e9b61dc962be6ad7fdd18fafb24b0c6ea3d2dbca9

Download Submit
/data/data/com.whatsapp/files/PersistedInstallation4016721184620025876tmp

Filesize
90B

MD5
d0a504c8a640b1d2d6a810193e8a4671

SHA1
f1463482d608479648737d2cc107971ea703bbf8

SHA256
cf0e97cf4ffde2be0d8c0f3b0f6e27c6296905de8db9a9e2d489f1a01337ce75

SHA512
588e1df3fcc528df8163337016e0e126a3ef7dc6b6b34e409fd0103901f343efc55ff8f0511f8ed2bc2176044c0a3c64e1b0470c19c76aab8920902512ca3ba3

Download Submit