329ccadb1f5a9027f7c85061cb5d2137343749f585120ce339e437ef2ccd18f9

Resubmissions

15-09-2024 13:05

240915-qbk16swaqk 10

11-08-2024 03:45

240811-ebk6dstdrq 6

10-08-2024 18:57

240810-xlxahssgrj 10

Analysis

max time kernel
2s
max time network
30s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
15-09-2024 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

whatsapp_Plus_17.85_whatsapplus.org.apk
Size

114.8MB
MD5

56ccacc70ccc328698edc296e183e9c8
SHA1

5c9bfdd00ae326c766611ed26770a1fd4acff73a
SHA256

329ccadb1f5a9027f7c85061cb5d2137343749f585120ce339e437ef2ccd18f9
SHA512

accbf2510ff0eb3dada21a001c5fc1eb8f66e9583ee270745eecfc9262d6adf120de38ec6feecd1ac188cdcb52babf8d54803ab9464729585d16f1f49a1666b6
SSDEEP

1572864:df3YFq69wcVm6+i5AEhKr+4QDuUaJRKfyMuK0aPKIUsqGM7UgolqKWG40rAIZBS/:dvYFHnKbEQWsGXuK0EHMJGWp0fZMd1

Score

7^/10

evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.aerowtsapp

ioc pid process

/system_ext/framework/androidx.window.sidecar.jar 4485 com.aerowtsapp
/system_ext/framework/androidx.window.sidecar.jar 4485 com.aerowtsapp

ioc	pid	process
/system_ext/framework/androidx.window.sidecar.jar	4485	com.aerowtsapp
/system_ext/framework/androidx.window.sidecar.jar	4485	com.aerowtsapp

com.aerowtsapp
1⤵
- Loads dropped Dex/Jar
PID:4485

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.aerowtsapp/.cache/classes.dve

Filesize
24B

MD5
ee206b8200ea91d4ea0d8baf141a38e2

SHA1
61cb84d7e451c63a552d1d5af676ecae1afb8a5d

SHA256
3a5487655a468c05990b05c47ef585409f0a299dc99bb2d0287dd50e99983c16

SHA512
696358162e70efacf6ecf6dde6b5f04b0ac0057e6ede79e89990492d2d1e0e5cfc5ffc62ad0801a0267502b0673fd74a6c4c850793a2b3738120345e3e795295

Download Submit
/data/user/0/com.aerowtsapp/.cache/classes.jar

Filesize
24.9MB

MD5
b9a5fcd22af6f0d910b5a03203fa3686

SHA1
857dfad7a6c17110879e86074ec61b5f2d68e73a

SHA256
2e65eece7f19709d1b5462e3fb2b364e55193096e9b092932d32771405dcd507

SHA512
484ece1672b3f3ea4ae293b337b0cfdfe0f8393977b25f4b7084f46c28f47d71a6d70dd66b239ad9be5889fe43de49280583ce8997d8ed6f8a39f0d29dac2eb3

Download Submit
/data/user/0/com.aerowtsapp/.cache/libSecShell32_x86.so

Filesize
1.3MB

MD5
c152b457d290c7d847a6b78d99e6e86c

SHA1
c9012f5e4232a261783d876433a840ce2f0af5c8

SHA256
26b7884ce133f917687bd528d2307bc221bb6f8d27fd1b3b0d4f1c462fc8eb33

SHA512
86176817a7fea6788921be494643a96dc0dbe77e2484c25e3a60f0f62fef84cc0f1c357b8d2199bd9ded5a208862f3daf089a802c46e6bca4393ad0a88f880b3

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit