General

  • Target

    OGWhatsAppProv20.85.apk

  • Size

    90.7MB

  • MD5

    cfb809f6b6583924ac3028f65fde7edd

  • SHA1

    6c722fd47a1bdbd2c4d4a25f6a6d047e26ad5582

  • SHA256

    e82485e1a587d5ab5004cefb214d3cc0635309816c505bb542b28dc9c2c6f27f

  • SHA512

    4f2a8131aae1b890e8d7900487d8fc1065b69b10f8e58f5a5a0c10c862237069705ec9e73d9c50f2bb27c7b49168d53687b54bd02e35b4232403f01265c76df6

  • SSDEEP

    1572864:dUxuK95aiftMn31Jo3qnZbcZT9fX1EgC3NADI24ehVGHfbn30HrF/OR:SuKmiFM31JgqJ0B1FC36I24dHfb3UZ/O

Score
10/10

Malware Config

Signatures

  • Android Triada payload 1 IoCs
  • Triada family
  • Patched UPX-packed file 2 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Declares services with permission to bind to the system 3 IoCs
  • Requests dangerous framework permissions 27 IoCs

Files

  • OGWhatsAppProv20.85.apk
    .apk android arch:arm64 arch:arm

    com.gbwhatsapp3

    androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity


Android Permissions

OGWhatsAppProv20.85.apk

Permissions

android.permission.USE_BIOMETRIC

android.permission.USE_FINGERPRINT

com.gbwhatsapp3.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.REORDER_TASKS

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.INTERNET

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.POST_NOTIFICATIONS

com.google.android.c2dm.permission.RECEIVE

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.VIBRATE

android.permission.RECEIVE_SMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.BLUETOOTH_CONNECT

android.permission.BLUETOOTH

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_MEDIA_LOCATION

android.permission.ACCESS_WIFI_STATE

android.permission.BROADCAST_STICKY

android.permission.CAMERA

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.FOREGROUND_SERVICE_LOCATION

android.permission.GET_TASKS

android.permission.INSTALL_SHORTCUT

android.permission.MANAGE_ACCOUNTS

android.permission.MANAGE_OWN_CALLS

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.NFC

android.permission.READ_CONTACTS

android.permission.READ_PROFILE

android.permission.READ_SYNC_SETTINGS

android.permission.READ_SYNC_STATS

android.permission.RECORD_AUDIO

android.permission.SCHEDULE_EXACT_ALARM

android.permission.SEND_SMS

android.permission.USE_CREDENTIALS

android.permission.WRITE_CONTACTS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_MEDIA_AUDIO

android.permission.READ_MEDIA_IMAGES