Resubmissions
20-09-2024 03:12
240920-dqpxfsvhqg 1004-09-2024 02:22
240904-ctxk2atclk 1004-09-2024 02:21
240904-cth3msvdqg 1004-09-2024 02:20
240904-csezlavdnc 10Analysis
-
max time kernel
10s -
max time network
15s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
20-09-2024 03:12
Behavioral task
behavioral1
Sample
WALiteX1.30.1Clone_By.WALiteX.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
WALiteX1.30.1Clone_By.WALiteX.apk
-
Size
74.3MB
-
MD5
dd360bb946a2cfc835dc82246acb5485
-
SHA1
52ce2853276b4f1643dc20aa2cd1989a6ede8741
-
SHA256
0fff458c0166d923d7a63b036e9d6353a4afde4bb89b7de09048a8fa146e8417
-
SHA512
6da75042eee2a4ead2a2ad829142c3d0bc17af551191b7d9de21f3e978db53c1b71ce3b765dbe7bd2f4b4b8921f6296feba1f26d558ed12f7e114d1d703adbce
-
SSDEEP
1572864:vI24ehVGHfbu4znXc/B46+uKgyWzitw8kZkrNLicLPL:vI24dHfbu4znXUR+uKg07gSPL
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4855 com.whatsapplitex /system_ext/framework/androidx.window.sidecar.jar 4855 com.whatsapplitex -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.whatsapplitex -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 26 raw.githubusercontent.com 27 raw.githubusercontent.com -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.whatsapplitex -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.whatsapplitex -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.whatsapplitex
Processes
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD50618ac070d3d6310bf93d308bf221ee1
SHA14af3cfaeca579d0451e25541b6269689f0e446e9
SHA256dd98241974487ce11a331a28a6eafb2f01b7eeb50ab579af07fce08ad6b076d5
SHA512d355d807e6a8e48264cd5b372f8b434133532a8e366f38a546c4e8de54fa125d1281d73bbf246aed3cca75ced39d70cb20c2a8b4a134d09ad3e7c35344a3a93f
-
Filesize
8KB
MD5f72158e5834357f68de05ad754d48e56
SHA1bf1f34ae968398645082cf79b01b41abcd326a70
SHA256ed8f539c10076bf92308f82d33ff699a3005b649f08fc43a2d9cac67bfd1687c
SHA5125b0ac4ed974fe9c9a99ff2cebdc72883e651bbdcc79b43845ee7797c835492978fcf47759e989cacb59ffacf95eca9b535fd8205d564c115cb9d7c2c530b217a
-
Filesize
512B
MD550551351765a59435660bfdfad04d71d
SHA123ddc33ebba3971b42a8d01771fc35fe308da716
SHA256f17d43350362f2d3093fd9bdb9731359e132121e91009a10af080857d0792646
SHA512bebf9f346b595c3886e140b04ffb970f113c59c7a01f48a31610c8dd83ababa22ce7342288cef504c8b99c5c25011468f39fdbddd6c83948386e862d897af207
-
Filesize
8KB
MD5880a95a5dd8a36c22eed4460d36540ba
SHA174178a96fb984fd93900f2a4d848529067915671
SHA2566efe48b92af8b8345303ae736d80d3cb077b3b2277ba3c71b4165453e5f167de
SHA51217a07d0c7cc36594cf76faadbbe45eb63e89e0fdcc8e0ba3a0c44d550a97a61ed50da62650739dd7ec1e1c28f5193216954282abd239a25a2ed7de164b24a7ae
-
Filesize
16KB
MD54b0019e8f12f0d091525326319ebf45e
SHA10fd2d0656898c0c1ffca5a6a75eb8bb2130b46dc
SHA256cbdfbb33d3dc882dc3f1d885e6e2990574f0b736d1288b9240819163ee9823cc
SHA5122fb4579601462d249227bad4530940d142f907dc562b38d419b9450683a10eb267a52d0a4eb8093a75db80f772b331c548902e884009520a7e0a5af38548e8e7
-
Filesize
512B
MD556fddc2e61ba6427708147e841d03ce0
SHA1e4bbfe36dab9c6b0f6c27a58f9daa96e4f102309
SHA2565487bc5a72162d3319a60276163822660a44eea4de81db67dd5858c4aee762e5
SHA51286ddd475dff77f0d6ad98db57e58c52564b5d287277555fcae7190f37b11cfa959a3f39611862e65e7ec4ab99d1043b9a76692d7136990443e1a7d37997c0011
-
Filesize
8KB
MD5ee4301ab468364a00dd8d59e42a0c835
SHA120ab129be4d90c81aa61645985f1a0fe11ac9848
SHA2563a87293bbca2bd73e4e6b18a88112bef5cc83047901ced9ee512aaef665dd42b
SHA51281c100546c661cd11289f4216d2554d133a099cb35d786dd0a9fbea9680ed2e56c87e95fd0f5692d78724e162fb4feb820f0640d6b948be307985139fd3f031d
-
Filesize
8KB
MD5106db1ead58ff1756803fd6dc954331d
SHA144643564692f5c84aacb2546dcef24f1ec749589
SHA256912c39e354b442db5c7b7538828f1b626ea01852467473540ea81fa7e1df28ad
SHA51262cd8285b9ad0d0df8a51daa96dba772ce6e76062a614346c73a906ddcc2438c871f3fbcbd36ade40d832e5bec3823332746641fb583cefa153c0d5566d2da82
-
Filesize
512B
MD5bcc3c74a267bf46b5112ff1841daa43f
SHA1f39101bb2ed75bebd1b3969413cfd30f951c52c5
SHA2565a70fb47382c3382c4bb2118c349ca051c577b6d59bb32ae2e3c9d070a2b7656
SHA512f5d1340b4d590b4f2cce91598b0cd31564815d01991855a2090e47647ef6c75d98bfe0a91844074f543fc3ffe05a2be413e4155427542aaaca23c030a6e25326
-
Filesize
16KB
MD566f52e8906979e99aec3301ce2c90280
SHA1a405e1755228570eecc055531d811352b1ea084e
SHA256869a847fd185f743808a13a14b479a75ee558f37af0ff02eebd51aaf2eb56934
SHA5124b59ebdef396856fd7950700a693c0a1217b1afcbdce6936682fa05c88e47a86316d52ce4152abcb750a75ec5ffd1bad2b6d681f4394beaa6c6e885d68804ecc
-
Filesize
56KB
MD5a2237b59b974ba1603736904e8f1e740
SHA1142dfbf8dec12e610d833fce531d5afb11e55ad0
SHA2560698dc2f8bfb1cebb9821b4f2c457929cf7b1f3b21d2636401c2c4603302a550
SHA512116d434236c104860f1d85990838463c6cc0f27784272e44458580f524abf657723a8f4f6c66fd01e8c67704ee44b402ba28a3e4a3ba490e00c86a65f86f1d8f
-
Filesize
512B
MD5a9ebc68f51c54e66a836e2f7d8a9167c
SHA13a1403b81453fecd6391af381b4e2605e263a5cd
SHA256d7812b592296c2337b2a2fd48ea509f3bb87f97880db8fc0984d6ff8d97844b4
SHA512f3fa15e9d4d7b8fda6b903c7ccd945d6ec31f73e1862885da5d181a5ea1b984b134f9d7affc0a59e1a2a7f3a10e7bd32dadef88d4590bb56c2e956cacc35ed95
-
Filesize
8KB
MD57b73aceb8511814b62d7e8062f63f48a
SHA1a5a78b9c1f1aeb9896307d067d1c2773dde55aa4
SHA256de82ac3abbf02f8b93f3458299177d9bf747e40f40a63e9a04fa5371c8164a99
SHA51251e7ce3cfbe20e625a37a95609dce49712b5f75d6d11d1dac37a62e841e1de6a7636be398a120f24b9e3c45cf8fa6bcef21a1cb854d6e86a485ac091907337cc
-
Filesize
8KB
MD58156e63ff8eb96ea5a624c5c7a59ca43
SHA172516f1ca0e514f7e716f4775c50c48e4979ed37
SHA25652cc46d00017fd6bc2f93e46e0ac166244c39477388546a3d4d48381f2063b6a
SHA512b65b5c1ef881b3847a6270b018343b6384e7fac48a970971fafe2b601a6d18dd025ba4546e9493c9f8cb7ab434daf976d8aa8104fd2737022a32e79c36b4e9fc
-
Filesize
512B
MD576bcf9b7ef99afedfaed5a3704474a78
SHA179939f4da26148d274c3681543a041b8e4bcdcfc
SHA256eeabbb0c3517603ec9934becef040718863cd0b1e6609fa37dd59ef1b6f19d83
SHA5120718838535562a33c36590a73c2fb41b2c9c2319f0d33f2a9017a0c4df4ff382c62d0a15a7447e7de383d61600148471c4859e081f437ccd29117fb4e9e200e9
-
Filesize
16KB
MD53f3ec35e6560b642fac7bd980bd37d30
SHA1f5a62429e959c07c79e64b936aadcfe4343fe049
SHA256981341939e3375ca4324d3948ace332c7d96ce7ad49571842518b05bfd98557a
SHA5128a7d72ea013adb3efedc6bb3080e204cc81de74b42e829f09197d070c7b4d84dde8933c8ebc2136876f6f798c9c723c60bf9e92817679e302c06d1d24c319a48
-
Filesize
128KB
MD5f83a37ae336b45aaef2cc064fb1a9c7c
SHA146c64d291a4e779b52f8f91e46046b2198db6563
SHA2569cee3760087a446c719bd4258b90a711e392f7c868fe1eefb26bba1481025bb8
SHA5128a86c73e45c25be722953ee7684762650603594ddef62d1d62784cfd1804e914b6ad7eb73a6c2455ef98232e5f8a7f6ade5a95064c57c5cdaaac9811e13586f4
-
Filesize
412KB
MD50b09fbacbeda8536ebb5734181bf55be
SHA1201ced32873345c1dedb484cb3c8e1f17e4cfe1c
SHA25669a8073fc984b00fa9ed03db2edde6ebeb9668d927803f026a4f5006b2b2fb51
SHA512d91441946f461c5e56c73d6c50e36fafda6ad249cf68ba44a54df6071bf3fcdef6096ff9871bf6d925fe733eb9075a7a76e95dabf2a9e28faf29949bd2512d77
-
Filesize
512B
MD5c806c9f9aa1ea5dadaa5b0c994aa82a0
SHA12c279124d6ef6d89e9371f3d43b7da74341080e1
SHA256b6983396d15aa9e83972e645f9c8cc2d3b84f1af4ff219e7a888e40219414786
SHA51279056a2da6a1e4e03c52c74a1501c0e5c2c065a8190d157abc10b2c3ba24a8d2bf854f05615309e04bbbb3f191ddab2676a6e7b9c25586a2eee1885bd07a5099
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
16KB
MD5ad7eca54e742c38e625e64d9b305c4fb
SHA18781ba8c1e5b69f0f08770756bd2b5faa044cd32
SHA2561c9b5e42e0f87af5837d323f98155b12ee3c4e4f2a8b0ad73de0696ad8157749
SHA5128d934f96c1a0b4434ddd023abe18bf869d09f43e2643af14d7146eb787753add76483cc1e97913e7e5799d56904f412d54621c4af1e751a60978f22bff35342e
-
Filesize
426KB
MD55d73eb3f82c5c165d8ebfda730257d2a
SHA1d830d98c6a3a9d22479e177d6f9d71f2a0c2a972
SHA25698576825423b2152edb61bda44ad65671f649b34f171d48da83b3c48dd904353
SHA512bc0bcd4347cd226dd79ddaf822340129fd00f684d012012cf9e68210ec08e3c506b465f3fdd64345639cfabaea939e47e9fd00c360b0ed5f74cb3cb5b13e892d
-
Filesize
20KB
MD5eff4fe3e9af59c3051d5a3d7efc64c2f
SHA1635ab73ab84988af85709f796708a8ab54f7b76c
SHA256f2594e6f2787b25ef0199af89a809d68b8fd3d46fad04ed058694b010194b264
SHA512be6186919efb2a30ec7e6d59099f86434b5e2389319773915083dea35fc8adb050d9c7edb802e385830d1a7a5c2aa7ca13fda48bddf9c7379f6537bbc6bdc0ea
-
Filesize
114B
MD50f31e224a9b080c2369e3f5269e6c9a6
SHA107674c06a9def5ae0139d841c8ccd3b86b40dfc7
SHA25665929e966f40b4f2c4bfa96bf2171a4453ebb07f9064397bc13222829cda5b99
SHA512e8aa94458bfeed761c1b40b94ca3ad29e047b407d36657d7e2efc31b9dc93038616945fff6d731af21c3cd49ac3887bff0992450f262635cddbb814c8bef983e
-
Filesize
90B
MD55a103733e5660d00914c336c733e9dc9
SHA18f13864841eea42ab1676c81308d86737eb04775
SHA256e54154c366ebd891f6c0eb8b0c5d5d4183cbebe3f5a4057051d792c0d55127b2
SHA5129edd5765f6eda3ce9f17bcc71c8cd6c810cd27ff7bc85af5809cd259a1fd265f3546a721420ce71d76313d9065d8f93e594e9a1f7c6a37b669c8df1838ca931f
-
Filesize
31B
MD5e1eb393a861728febc3d05fcc7641789
SHA1baef5288a57138fde577ad0dbbcbd71a9c220087
SHA2560f38b78ce75bd279560358c3209139abe53e2e38b4a286cb8b0cd2c827c71ef6
SHA512c427c7f15b185f1ae84be827264051a64155bc594fa7f6222c85297fd4771769621cbc5de3d1e3a654c530c2d85f3ea77e763dd1286bd164d955f7d8ba1b7eb7
-
Filesize
213KB
MD579a7b896132e3425306c22ee9245b1b3
SHA1c2644a692a75b291253d84eac34186e627325fbb
SHA2561dffc9205463e064a73076f5cc8ed4f688250c06709ac3d23324aa29dd70e81d
SHA5126cefeea15c0a4086e13c3c6d09e646c473a301bcf25dbc2f8c091d2988d6fdc50d069ecb3c3cfa9908773c77ae6a8280581ccc8887c224f1c729e974097d411f
-
Filesize
396B
MD5df248c8709657a8cd43ad196668514df
SHA1f289a0c021abfc28b42573760b5b45cd2f2312c4
SHA256b8a6e2784e9a72fdcdcf1a528564238009d5f737e509d1bcce67963fa821925e
SHA512dfee69986882c3f5e09412400762b10146f8a5dbed4e3f773bf68cba5938071befd23a750eb4e05ce978cf67310f8372d2def9a40d2b1a9a74a2f61ea3ce6ae0
-
Filesize
5B
MD5c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA256957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
SHA51229f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
-
Filesize
1B
MD593b885adfe0da089cdf634904fd59f71
SHA15ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA2566e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
-
Filesize
1B
MD555a54008ad1ba589aa210d2629c1df41
SHA1bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA2564bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA5127b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD58a899c38c917f5ad6486c37b79ae3abf
SHA1782117f72eb8ce8f1fce61d7be88edc089b1136f
SHA256c19cbafc1c98cdca6e03d45a1ff59fcefaef1a5264cc0365c66368a130215c85
SHA51202027a979f916909de58753af82ab493779687b3adf79f304a74b94de0b335f542c65ea31bc447e86d3f2391156700fce43080fbc20af9ce1c660d55eb27b379
-
Filesize
16KB
MD5c73513ab5f25d50cc3cab62e42e40d8f
SHA155cc345723cb9b3663f01b218de6d0b2631c6053
SHA256e1fdfdaedb6ca4a7d27b603ff8f6fa4da5965fe187e32801ac1fdb9acaae064c
SHA512eaaee9b2b05f5413d3b71efe251c6d1c0b3f076b748feee330c01fa6618f4ab4123b1e86fb4d62fad7b66e9640b50970f21a622d309a322af2c543f9677b4645
-
Filesize
116KB
MD53e9429cc36e950790ee5461ee2efad59
SHA1023dbc18ca33ab327ac0a3cd02e799633a881ab8
SHA25652ae008a4aea8265609afdfa93ef76cbad810fff8efcdc5258daadc49ca2bb10
SHA51201e838e87ada902cf3f1368ece4d048a680af9375b0fd8bf0328caaf2ce00f0757406beb3dba03c8f27f1d1dc0e45907706e700f0013f9320f0fdd7988fa8399
-
Filesize
181KB
MD59f7cf1ff9cfcbb0e5433679bf5d18eca
SHA168622646c6d23acbe5d257c9732687136a88940a
SHA25662017b5f8b880dfa1d52d823a5f365f8bfa8318986f35e2b18c907e29bb04d15
SHA51219dd9c9663bae36b679aff798f7bdabf851e5e01a656e6d0294c7fb6d4b5e12352bdb73034fae8481b4f0c9117fc0907214286309b43c5416c31ae661522f73c
-
Filesize
12KB
MD5bdf3529e80318eb14e53a5bf3720c10d
SHA125c9ace4b1af6e80ebb2572345972c56505969ba
SHA256bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA51248b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b