Resubmissions

20-09-2024 03:12

240920-dqpxfsvhqg 10

04-09-2024 02:22

240904-ctxk2atclk 10

04-09-2024 02:21

240904-cth3msvdqg 10

04-09-2024 02:20

240904-csezlavdnc 10

Analysis

  • max time kernel
    10s
  • max time network
    15s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    20-09-2024 03:12

General

  • Target

    WALiteX1.30.1Clone_By.WALiteX.apk

  • Size

    74.3MB

  • MD5

    dd360bb946a2cfc835dc82246acb5485

  • SHA1

    52ce2853276b4f1643dc20aa2cd1989a6ede8741

  • SHA256

    0fff458c0166d923d7a63b036e9d6353a4afde4bb89b7de09048a8fa146e8417

  • SHA512

    6da75042eee2a4ead2a2ad829142c3d0bc17af551191b7d9de21f3e978db53c1b71ce3b765dbe7bd2f4b4b8921f6296feba1f26d558ed12f7e114d1d703adbce

  • SSDEEP

    1572864:vI24ehVGHfbu4znXc/B46+uKgyWzitw8kZkrNLicLPL:vI24dHfbu4znXUR+uKg07gSPL

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.whatsapplitex
    1⤵
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4855

Network

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.whatsapplitex/databases/BTOR.DB

    Filesize

    20KB

    MD5

    0618ac070d3d6310bf93d308bf221ee1

    SHA1

    4af3cfaeca579d0451e25541b6269689f0e446e9

    SHA256

    dd98241974487ce11a331a28a6eafb2f01b7eeb50ab579af07fce08ad6b076d5

    SHA512

    d355d807e6a8e48264cd5b372f8b434133532a8e366f38a546c4e8de54fa125d1281d73bbf246aed3cca75ced39d70cb20c2a8b4a134d09ad3e7c35344a3a93f

  • /data/data/com.whatsapplitex/databases/BTOR.DB-journal

    Filesize

    8KB

    MD5

    f72158e5834357f68de05ad754d48e56

    SHA1

    bf1f34ae968398645082cf79b01b41abcd326a70

    SHA256

    ed8f539c10076bf92308f82d33ff699a3005b649f08fc43a2d9cac67bfd1687c

    SHA512

    5b0ac4ed974fe9c9a99ff2cebdc72883e651bbdcc79b43845ee7797c835492978fcf47759e989cacb59ffacf95eca9b535fd8205d564c115cb9d7c2c530b217a

  • /data/data/com.whatsapplitex/databases/BTOR.DB-journal

    Filesize

    512B

    MD5

    50551351765a59435660bfdfad04d71d

    SHA1

    23ddc33ebba3971b42a8d01771fc35fe308da716

    SHA256

    f17d43350362f2d3093fd9bdb9731359e132121e91009a10af080857d0792646

    SHA512

    bebf9f346b595c3886e140b04ffb970f113c59c7a01f48a31610c8dd83ababa22ce7342288cef504c8b99c5c25011468f39fdbddd6c83948386e862d897af207

  • /data/data/com.whatsapplitex/databases/BTOR.DB-journal

    Filesize

    8KB

    MD5

    880a95a5dd8a36c22eed4460d36540ba

    SHA1

    74178a96fb984fd93900f2a4d848529067915671

    SHA256

    6efe48b92af8b8345303ae736d80d3cb077b3b2277ba3c71b4165453e5f167de

    SHA512

    17a07d0c7cc36594cf76faadbbe45eb63e89e0fdcc8e0ba3a0c44d550a97a61ed50da62650739dd7ec1e1c28f5193216954282abd239a25a2ed7de164b24a7ae

  • /data/data/com.whatsapplitex/databases/_jobqueue-WhatsAppJobManager

    Filesize

    16KB

    MD5

    4b0019e8f12f0d091525326319ebf45e

    SHA1

    0fd2d0656898c0c1ffca5a6a75eb8bb2130b46dc

    SHA256

    cbdfbb33d3dc882dc3f1d885e6e2990574f0b736d1288b9240819163ee9823cc

    SHA512

    2fb4579601462d249227bad4530940d142f907dc562b38d419b9450683a10eb267a52d0a4eb8093a75db80f772b331c548902e884009520a7e0a5af38548e8e7

  • /data/data/com.whatsapplitex/databases/_jobqueue-WhatsAppJobManager-journal

    Filesize

    512B

    MD5

    56fddc2e61ba6427708147e841d03ce0

    SHA1

    e4bbfe36dab9c6b0f6c27a58f9daa96e4f102309

    SHA256

    5487bc5a72162d3319a60276163822660a44eea4de81db67dd5858c4aee762e5

    SHA512

    86ddd475dff77f0d6ad98db57e58c52564b5d287277555fcae7190f37b11cfa959a3f39611862e65e7ec4ab99d1043b9a76692d7136990443e1a7d37997c0011

  • /data/data/com.whatsapplitex/databases/_jobqueue-WhatsAppJobManager-journal

    Filesize

    8KB

    MD5

    ee4301ab468364a00dd8d59e42a0c835

    SHA1

    20ab129be4d90c81aa61645985f1a0fe11ac9848

    SHA256

    3a87293bbca2bd73e4e6b18a88112bef5cc83047901ced9ee512aaef665dd42b

    SHA512

    81c100546c661cd11289f4216d2554d133a099cb35d786dd0a9fbea9680ed2e56c87e95fd0f5692d78724e162fb4feb820f0640d6b948be307985139fd3f031d

  • /data/data/com.whatsapplitex/databases/_jobqueue-WhatsAppJobManager-journal

    Filesize

    8KB

    MD5

    106db1ead58ff1756803fd6dc954331d

    SHA1

    44643564692f5c84aacb2546dcef24f1ec749589

    SHA256

    912c39e354b442db5c7b7538828f1b626ea01852467473540ea81fa7e1df28ad

    SHA512

    62cd8285b9ad0d0df8a51daa96dba772ce6e76062a614346c73a906ddcc2438c871f3fbcbd36ade40d832e5bec3823332746641fb583cefa153c0d5566d2da82

  • /data/data/com.whatsapplitex/databases/axolotl.db-journal

    Filesize

    512B

    MD5

    bcc3c74a267bf46b5112ff1841daa43f

    SHA1

    f39101bb2ed75bebd1b3969413cfd30f951c52c5

    SHA256

    5a70fb47382c3382c4bb2118c349ca051c577b6d59bb32ae2e3c9d070a2b7656

    SHA512

    f5d1340b4d590b4f2cce91598b0cd31564815d01991855a2090e47647ef6c75d98bfe0a91844074f543fc3ffe05a2be413e4155427542aaaca23c030a6e25326

  • /data/data/com.whatsapplitex/databases/axolotl.db-wal

    Filesize

    16KB

    MD5

    66f52e8906979e99aec3301ce2c90280

    SHA1

    a405e1755228570eecc055531d811352b1ea084e

    SHA256

    869a847fd185f743808a13a14b479a75ee558f37af0ff02eebd51aaf2eb56934

    SHA512

    4b59ebdef396856fd7950700a693c0a1217b1afcbdce6936682fa05c88e47a86316d52ce4152abcb750a75ec5ffd1bad2b6d681f4394beaa6c6e885d68804ecc

  • /data/data/com.whatsapplitex/databases/com.google.android.datatransport.events

    Filesize

    56KB

    MD5

    a2237b59b974ba1603736904e8f1e740

    SHA1

    142dfbf8dec12e610d833fce531d5afb11e55ad0

    SHA256

    0698dc2f8bfb1cebb9821b4f2c457929cf7b1f3b21d2636401c2c4603302a550

    SHA512

    116d434236c104860f1d85990838463c6cc0f27784272e44458580f524abf657723a8f4f6c66fd01e8c67704ee44b402ba28a3e4a3ba490e00c86a65f86f1d8f

  • /data/data/com.whatsapplitex/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    a9ebc68f51c54e66a836e2f7d8a9167c

    SHA1

    3a1403b81453fecd6391af381b4e2605e263a5cd

    SHA256

    d7812b592296c2337b2a2fd48ea509f3bb87f97880db8fc0984d6ff8d97844b4

    SHA512

    f3fa15e9d4d7b8fda6b903c7ccd945d6ec31f73e1862885da5d181a5ea1b984b134f9d7affc0a59e1a2a7f3a10e7bd32dadef88d4590bb56c2e956cacc35ed95

  • /data/data/com.whatsapplitex/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    7b73aceb8511814b62d7e8062f63f48a

    SHA1

    a5a78b9c1f1aeb9896307d067d1c2773dde55aa4

    SHA256

    de82ac3abbf02f8b93f3458299177d9bf747e40f40a63e9a04fa5371c8164a99

    SHA512

    51e7ce3cfbe20e625a37a95609dce49712b5f75d6d11d1dac37a62e841e1de6a7636be398a120f24b9e3c45cf8fa6bcef21a1cb854d6e86a485ac091907337cc

  • /data/data/com.whatsapplitex/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    8156e63ff8eb96ea5a624c5c7a59ca43

    SHA1

    72516f1ca0e514f7e716f4775c50c48e4979ed37

    SHA256

    52cc46d00017fd6bc2f93e46e0ac166244c39477388546a3d4d48381f2063b6a

    SHA512

    b65b5c1ef881b3847a6270b018343b6384e7fac48a970971fafe2b601a6d18dd025ba4546e9493c9f8cb7ab434daf976d8aa8104fd2737022a32e79c36b4e9fc

  • /data/data/com.whatsapplitex/databases/sync.db-journal

    Filesize

    512B

    MD5

    76bcf9b7ef99afedfaed5a3704474a78

    SHA1

    79939f4da26148d274c3681543a041b8e4bcdcfc

    SHA256

    eeabbb0c3517603ec9934becef040718863cd0b1e6609fa37dd59ef1b6f19d83

    SHA512

    0718838535562a33c36590a73c2fb41b2c9c2319f0d33f2a9017a0c4df4ff382c62d0a15a7447e7de383d61600148471c4859e081f437ccd29117fb4e9e200e9

  • /data/data/com.whatsapplitex/databases/sync.db-wal

    Filesize

    16KB

    MD5

    3f3ec35e6560b642fac7bd980bd37d30

    SHA1

    f5a62429e959c07c79e64b936aadcfe4343fe049

    SHA256

    981341939e3375ca4324d3948ace332c7d96ce7ad49571842518b05bfd98557a

    SHA512

    8a7d72ea013adb3efedc6bb3080e204cc81de74b42e829f09197d070c7b4d84dde8933c8ebc2136876f6f798c9c723c60bf9e92817679e302c06d1d24c319a48

  • /data/data/com.whatsapplitex/databases/sync.db-wal

    Filesize

    128KB

    MD5

    f83a37ae336b45aaef2cc064fb1a9c7c

    SHA1

    46c64d291a4e779b52f8f91e46046b2198db6563

    SHA256

    9cee3760087a446c719bd4258b90a711e392f7c868fe1eefb26bba1481025bb8

    SHA512

    8a86c73e45c25be722953ee7684762650603594ddef62d1d62784cfd1804e914b6ad7eb73a6c2455ef98232e5f8a7f6ade5a95064c57c5cdaaac9811e13586f4

  • /data/data/com.whatsapplitex/databases/wa.db

    Filesize

    412KB

    MD5

    0b09fbacbeda8536ebb5734181bf55be

    SHA1

    201ced32873345c1dedb484cb3c8e1f17e4cfe1c

    SHA256

    69a8073fc984b00fa9ed03db2edde6ebeb9668d927803f026a4f5006b2b2fb51

    SHA512

    d91441946f461c5e56c73d6c50e36fafda6ad249cf68ba44a54df6071bf3fcdef6096ff9871bf6d925fe733eb9075a7a76e95dabf2a9e28faf29949bd2512d77

  • /data/data/com.whatsapplitex/databases/wa.db-journal

    Filesize

    512B

    MD5

    c806c9f9aa1ea5dadaa5b0c994aa82a0

    SHA1

    2c279124d6ef6d89e9371f3d43b7da74341080e1

    SHA256

    b6983396d15aa9e83972e645f9c8cc2d3b84f1af4ff219e7a888e40219414786

    SHA512

    79056a2da6a1e4e03c52c74a1501c0e5c2c065a8190d157abc10b2c3ba24a8d2bf854f05615309e04bbbb3f191ddab2676a6e7b9c25586a2eee1885bd07a5099

  • /data/data/com.whatsapplitex/databases/wa.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.whatsapplitex/databases/wa.db-wal

    Filesize

    16KB

    MD5

    ad7eca54e742c38e625e64d9b305c4fb

    SHA1

    8781ba8c1e5b69f0f08770756bd2b5faa044cd32

    SHA256

    1c9b5e42e0f87af5837d323f98155b12ee3c4e4f2a8b0ad73de0696ad8157749

    SHA512

    8d934f96c1a0b4434ddd023abe18bf869d09f43e2643af14d7146eb787753add76483cc1e97913e7e5799d56904f412d54621c4af1e751a60978f22bff35342e

  • /data/data/com.whatsapplitex/databases/wa.db-wal

    Filesize

    426KB

    MD5

    5d73eb3f82c5c165d8ebfda730257d2a

    SHA1

    d830d98c6a3a9d22479e177d6f9d71f2a0c2a972

    SHA256

    98576825423b2152edb61bda44ad65671f649b34f171d48da83b3c48dd904353

    SHA512

    bc0bcd4347cd226dd79ddaf822340129fd00f684d012012cf9e68210ec08e3c506b465f3fdd64345639cfabaea939e47e9fd00c360b0ed5f74cb3cb5b13e892d

  • /data/data/com.whatsapplitex/files/Logs/whatsapp.log

    Filesize

    20KB

    MD5

    eff4fe3e9af59c3051d5a3d7efc64c2f

    SHA1

    635ab73ab84988af85709f796708a8ab54f7b76c

    SHA256

    f2594e6f2787b25ef0199af89a809d68b8fd3d46fad04ed058694b010194b264

    SHA512

    be6186919efb2a30ec7e6d59099f86434b5e2389319773915083dea35fc8adb050d9c7edb802e385830d1a7a5c2aa7ca13fda48bddf9c7379f6537bbc6bdc0ea

  • /data/data/com.whatsapplitex/files/PersistedInstallation1819792788122722982tmp

    Filesize

    114B

    MD5

    0f31e224a9b080c2369e3f5269e6c9a6

    SHA1

    07674c06a9def5ae0139d841c8ccd3b86b40dfc7

    SHA256

    65929e966f40b4f2c4bfa96bf2171a4453ebb07f9064397bc13222829cda5b99

    SHA512

    e8aa94458bfeed761c1b40b94ca3ad29e047b407d36657d7e2efc31b9dc93038616945fff6d731af21c3cd49ac3887bff0992450f262635cddbb814c8bef983e

  • /data/data/com.whatsapplitex/files/PersistedInstallation8869570763246411135tmp

    Filesize

    90B

    MD5

    5a103733e5660d00914c336c733e9dc9

    SHA1

    8f13864841eea42ab1676c81308d86737eb04775

    SHA256

    e54154c366ebd891f6c0eb8b0c5d5d4183cbebe3f5a4057051d792c0d55127b2

    SHA512

    9edd5765f6eda3ce9f17bcc71c8cd6c810cd27ff7bc85af5809cd259a1fd265f3546a721420ce71d76313d9065d8f93e594e9a1f7c6a37b669c8df1838ca931f

  • /data/data/com.whatsapplitex/files/decompressed/libs.spo/.superpack_version

    Filesize

    31B

    MD5

    e1eb393a861728febc3d05fcc7641789

    SHA1

    baef5288a57138fde577ad0dbbcbd71a9c220087

    SHA256

    0f38b78ce75bd279560358c3209139abe53e2e38b4a286cb8b0cd2c827c71ef6

    SHA512

    c427c7f15b185f1ae84be827264051a64155bc594fa7f6222c85297fd4771769621cbc5de3d1e3a654c530c2d85f3ea77e763dd1286bd164d955f7d8ba1b7eb7

  • /data/data/com.whatsapplitex/files/extracted_pack_file.pack.tmp

    Filesize

    213KB

    MD5

    79a7b896132e3425306c22ee9245b1b3

    SHA1

    c2644a692a75b291253d84eac34186e627325fbb

    SHA256

    1dffc9205463e064a73076f5cc8ed4f688250c06709ac3d23324aa29dd70e81d

    SHA512

    6cefeea15c0a4086e13c3c6d09e646c473a301bcf25dbc2f8c091d2988d6fdc50d069ecb3c3cfa9908773c77ae6a8280581ccc8887c224f1c729e974097d411f

  • /data/data/com.whatsapplitex/lib-main/dso_deps

    Filesize

    396B

    MD5

    df248c8709657a8cd43ad196668514df

    SHA1

    f289a0c021abfc28b42573760b5b45cd2f2312c4

    SHA256

    b8a6e2784e9a72fdcdcf1a528564238009d5f737e509d1bcce67963fa821925e

    SHA512

    dfee69986882c3f5e09412400762b10146f8a5dbed4e3f773bf68cba5938071befd23a750eb4e05ce978cf67310f8372d2def9a40d2b1a9a74a2f61ea3ce6ae0

  • /data/data/com.whatsapplitex/lib-main/dso_manifest

    Filesize

    5B

    MD5

    c06857e9ea338f3f3a24bb78f8fbdf6f

    SHA1

    c5a0a2529d2deb60fec041b4fbd722a2ebe31702

    SHA256

    957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

    SHA512

    29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

  • /data/data/com.whatsapplitex/lib-main/dso_state

    Filesize

    1B

    MD5

    93b885adfe0da089cdf634904fd59f71

    SHA1

    5ba93c9db0cff93f52b521d7420e43f6eda2784f

    SHA256

    6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

    SHA512

    b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

  • /data/data/com.whatsapplitex/lib-main/dso_state

    Filesize

    1B

    MD5

    55a54008ad1ba589aa210d2629c1df41

    SHA1

    bf8b4530d8d246dd74ac53a13471bba17941dff7

    SHA256

    4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

    SHA512

    7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

  • /data/data/com.whatsapplitex/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.whatsapplitex/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    8a899c38c917f5ad6486c37b79ae3abf

    SHA1

    782117f72eb8ce8f1fce61d7be88edc089b1136f

    SHA256

    c19cbafc1c98cdca6e03d45a1ff59fcefaef1a5264cc0365c66368a130215c85

    SHA512

    02027a979f916909de58753af82ab493779687b3adf79f304a74b94de0b335f542c65ea31bc447e86d3f2391156700fce43080fbc20af9ce1c660d55eb27b379

  • /data/data/com.whatsapplitex/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    c73513ab5f25d50cc3cab62e42e40d8f

    SHA1

    55cc345723cb9b3663f01b218de6d0b2631c6053

    SHA256

    e1fdfdaedb6ca4a7d27b603ff8f6fa4da5965fe187e32801ac1fdb9acaae064c

    SHA512

    eaaee9b2b05f5413d3b71efe251c6d1c0b3f076b748feee330c01fa6618f4ab4123b1e86fb4d62fad7b66e9640b50970f21a622d309a322af2c543f9677b4645

  • /data/data/com.whatsapplitex/no_backup/androidx.work.workdb-wal

    Filesize

    116KB

    MD5

    3e9429cc36e950790ee5461ee2efad59

    SHA1

    023dbc18ca33ab327ac0a3cd02e799633a881ab8

    SHA256

    52ae008a4aea8265609afdfa93ef76cbad810fff8efcdc5258daadc49ca2bb10

    SHA512

    01e838e87ada902cf3f1368ece4d048a680af9375b0fd8bf0328caaf2ce00f0757406beb3dba03c8f27f1d1dc0e45907706e700f0013f9320f0fdd7988fa8399

  • /data/data/com.whatsapplitex/no_backup/androidx.work.workdb-wal

    Filesize

    181KB

    MD5

    9f7cf1ff9cfcbb0e5433679bf5d18eca

    SHA1

    68622646c6d23acbe5d257c9732687136a88940a

    SHA256

    62017b5f8b880dfa1d52d823a5f365f8bfa8318986f35e2b18c907e29bb04d15

    SHA512

    19dd9c9663bae36b679aff798f7bdabf851e5e01a656e6d0294c7fb6d4b5e12352bdb73034fae8481b4f0c9117fc0907214286309b43c5416c31ae661522f73c

  • /system_ext/framework/androidx.window.sidecar.jar

    Filesize

    12KB

    MD5

    bdf3529e80318eb14e53a5bf3720c10d

    SHA1

    25c9ace4b1af6e80ebb2572345972c56505969ba

    SHA256

    bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

    SHA512

    48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b