triada | 75372e4899e8b4074cfa2ff2fa51ae30c7a9f9c82f01bfeedf77d5b07d9038a0

Analysis

max time kernel
9s
max time network
16s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-09-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Whatsapp-CuBlack-Clone-v17.apk
Size

80.2MB
MD5

e6ff31beccb7ef842cbb08d117c44ba6
SHA1

8049a79abace487104507cf38f562912162a5244
SHA256

75372e4899e8b4074cfa2ff2fa51ae30c7a9f9c82f01bfeedf77d5b07d9038a0
SHA512

cbcba307f52d684d4bfa92344a0cf32887bc6fcafcbbc3eb16595263d6920273dbffbe71df2e9936fb99f85a38ce220f7eb74dc643749812df70f322a9222072
SSDEEP

1572864:P3uGZsJCC55suWYahu4H2U+X2itPwpJhq0Xe910KSY8EvlOjAQixW0MmDq3F:WhCaWY2zNoGqe410QOIW0rDq3F

Score

10^/10

triada banker evasion impact infostealer trojan

Malware Config

Signatures

Android Triada payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-8.dat	family_triada

Triada
Triada is an Android banking trojan first seen in 2016.
trojan infostealer banker triada

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.arcwhatsapw/app_ded/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.dex	4374	com.arcwhatsapw
/data/user/0/com.arcwhatsapw/app_ded/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.dex	4416	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.arcwhatsapw/app_ded/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.arcwhatsapw/app_ded/oat/x86/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.arcwhatsapw/app_ded/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.dex	4374	com.arcwhatsapw
/data/user/0/com.arcwhatsapw/app_ded/IMyeDbCRaRDmxQ1zFUMIJ6yaVcJoF4fM.dex	4374	com.arcwhatsapw
/data/user/0/com.arcwhatsapw/app_ded/IMyeDbCRaRDmxQ1zFUMIJ6yaVcJoF4fM.dex	4445	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.arcwhatsapw/app_ded/IMyeDbCRaRDmxQ1zFUMIJ6yaVcJoF4fM.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.arcwhatsapw/app_ded/oat/x86/IMyeDbCRaRDmxQ1zFUMIJ6yaVcJoF4fM.odex --compiler-filter=quicken --class-loader-context=&

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.arcwhatsapw

com.arcwhatsapw
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4374
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.arcwhatsapw/app_ded/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.arcwhatsapw/app_ded/oat/x86/stgWRyuguBPxyUJNTQyFVnZZrhRBPGSq.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4416
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.arcwhatsapw/app_ded/IMyeDbCRaRDmxQ1zFUMIJ6yaVcJoF4fM.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.arcwhatsapw/app_ded/oat/x86/IMyeDbCRaRDmxQ1zFUMIJ6yaVcJoF4fM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4445

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact