triada | hxxp://google[.]com

Resubmissions

26-09-2024 13:55

240926-q8lnzazhqr 10

Analysis

max time kernel
764s
max time network
2697s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
26-09-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

triada banker infostealer trojan

Malware Config

Signatures

Android Triada payload 1 IoCs

Processes:

resource	yara_rule
/storage/emulated/0/Download/.pending-1727964248-WhatsApp.apk	family_triada

Triada
Triada is an Android banking trojan first seen in 2016.
trojan infostealer banker triada

Declares services with permission to bind to the system 4 IoCs

Processes:

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Requests dangerous framework permissions 23 IoCs

Processes:

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.android.chrome

description ioc process

File opened for read /proc/cpuinfo com.android.chrome
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.android.chrome

description ioc process

File opened for read /proc/meminfo com.android.chrome

description	ioc	process
File opened for read	/proc/cpuinfo	com.android.chrome

description	ioc	process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4319

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
265KB

MD5
010d51cba6f8fbeae868f5a12f0a9797

SHA1
8dd31b2cebd212ac3297c17fb5ea28c9c725cdfb

SHA256
48e68f7af6ab64c3ae526cf5a2d1d699318bf85a4224efdf5fb574e77d6b659b

SHA512
3a9f050db594b798988802d69ee9638af4ddb079d745bf6280171e3730f7f05e67bb7a466ae7fd1c1baa6f270cc8bc69cee8a38984d37c76e2c394d9aea27579

Download Submit
/storage/emulated/0/Download/.pending-1727964099-Telegram.apk

Filesize
8.3MB

MD5
8584395d8dd81c8a6b441ebcbc7a1062

SHA1
a4e2096afc7fc23b55362b6d83e51c86444d5c13

SHA256
8d24e59c48d47b57ac4a72d71b82586318ba56bde6b08026a15dd45cddf14cfa

SHA512
f0fb84374887b5d09b76b26f0f646f0ec23a009aca6bd4722a22b0eaf14bb5eefe72150a29050904764b005082c3696ed11d9b29beea106af74d1ae250277afe

Download Submit
/storage/emulated/0/Download/.pending-1727964099-Telegram.apk

Filesize
69.2MB

MD5
3aede847cee5b0881940b9ea32feca98

SHA1
f2a3760d4bf50646300054dca9f91075e5f0dacd

SHA256
be6f640e30da8a42d4d45bf9ebd4a3d7e6293fa5e8f4bdb584882326e7c1a358

SHA512
3803b8891d9136c72fdfc8b2fab3730a80d2c5e3636b61e8b9c4a68a827e340b650953a4eb340253268b0cc9df45895f33d20be8c2f4674a856415ffd01bc57e

Download Submit
/storage/emulated/0/Download/.pending-1727964099-Telegram.apk (deleted)

Filesize
1.2MB

MD5
3959720d00a3cf3b5ec4eeb6c587fa75

SHA1
7cbe0a1151fd33f4456d0cfb2b8f080eef286588

SHA256
9a858ba06fb42665622c1f1f97e94b20ff669b88cc3dd5c659aed72624dd22f2

SHA512
e204fa67035b288dc5dbdba302d96efc7246c9aea7077f4716d7077d86b79913073e9d476b48ba3b55c5aeeff69d036ef85659561695a16ca37f36811a8e273d

Download Submit
/storage/emulated/0/Download/.pending-1727964248-WhatsApp.apk

Filesize
23.9MB

MD5
625350dc7e6cf0c9dea11b4c58254533

SHA1
fa7d1b4788ec2dc3f0f6e330257f39a7cb66f177

SHA256
55a802513055124a4e93d33951a9b30c83e2df7b16fe33a10b2c73017b3b9207

SHA512
7cff5e2b218ef2014eb4eec8520adc849695182ffa9fb82ca806f218d37cfb2a2b653694369d48edd6602a35ac1eda6dcda92bab233e874c5bdba5eabe5b5260

Download Submit
/storage/emulated/0/Download/.pending-1727964248-WhatsApp.apk

Filesize
99.3MB

MD5
b3c8182eec270ca69d6bf49f4d7ed34b

SHA1
f4dfcc72f5f64a6cde88cccd2f4d58a9d963bb9a

SHA256
356eb19f6d5639fa4a4795692f98b24aebb1e0cd1580700a2188ee92af396133

SHA512
1f2915b3d58aba2384bd20d3afc5bf5613f070f39c50178c8240f82a1196297896e0c0eaebcdf10ae29f479387b0d03b30e6b72c7e4fc00f1d53b5904b7aafd4

Download Submit
/storage/emulated/0/Download/.pending-1727964248-WhatsApp.apk (deleted)

Filesize
8.7MB

MD5
d093d329d081cb8c279fe652c04e472b

SHA1
e29a8f2f6645a6f5b17dd5ebef4d83a59229840f

SHA256
7720ec7be8fdad4d7b610ab6ac17f3812a421a915010c8d163f253bc4132d118

SHA512
b9d5f1405290abe40d4b9cd4f9c5097e4e3f28784235f3b2d2022ca587a9a41adb8beeef8a803dca6646b9cd02853228613e68fc4d236f157c57df4761f0fa01

Download Submit
/storage/emulated/0/Download/.pending-1727964464-Hello Neighbor_2.3.8_APKPure.apk

Filesize
1.9MB

MD5
b5c99f1d7077007b1224c1f351a63a2b

SHA1
26d6d8d3cfe2054f42c1be0a7db5cf3dfdc4555e

SHA256
25f561e2980db6e7c4bb36f11e59316cb12cacca70676a9a28afd87404640602

SHA512
edc87d81872e9b869be614d028dd624105eaa467f8b52b2927cfe306ade198b89e325a6d8f260a9c2de9a1b3b0c439f334604e9bc6deee26c85948cc7e16cffd

Download Submit
/storage/emulated/0/Download/.pending-1727964464-Hello Neighbor_2.3.8_APKPure.apk

Filesize
2.0MB

MD5
7329f5c114ce20ffc6d0eb11b4796bce

SHA1
0aea9b8a621f0e8308133ca7c685b78423d9e247

SHA256
32af179f75286ea2e0ca8c72b29638069d1e900778b8bd2aac32142fa63f3607

SHA512
13c0ed8d2194b6b4949bd64370dc4a1a6174c3bd2cff8e8a9c91e2a1342998a68bea4108357e735eaab21376585dcee6dbf170187013aeb666bb6d161a4b24f4

Download Submit
/storage/emulated/0/Download/.pending-1727964464-Hello Neighbor_2.3.8_APKPure.apk

Filesize
64.5MB

MD5
1771957982188d9b784b84d5f55be9da

SHA1
65a337088c764e867862bd8ee98a4682d8035130

SHA256
6e7934537ec0696ff17d68f0f23111e8db7d314dd434233a32e1b44bc26d634c

SHA512
b3b5daa9c3eae27ecd5c7a40d203967fdc0fe8a37a71f126b86973c42e239931eaa3e3211428446863ff62e1cb439b97901f51a18165d59745c710b0aea99c6d

Download Submit
/storage/emulated/0/Download/.pending-1727964464-Hello Neighbor_2.3.8_APKPure.apk (deleted)

Filesize
783KB

MD5
164c62c0b4973971b14311ea4c65d58f

SHA1
786c0e23ab9787747d9832e1d9494ffdccc867d0

SHA256
a19a05f4c091fcc5a996064ecedaac86eab5618c9fa5033150c3bcc79da4ed36

SHA512
61ee70f1a79adff6b75b75a4796185d0505143ed5cdaf4740decec1423dd2755b9657e5b91821cf17831a67104b8c780f72c79de6c31014eb06017e2d4b3bd66

Download Submit
/storage/emulated/0/Download/.pending-1727964536-Hello Neighbor_2.3.8_APKPure.xapk

Filesize
63KB

MD5
98b3601b3291eed9dcf561a8abc145ab

SHA1
b025c5d2c088d8d74a98563dcba855362b1a6a7c

SHA256
1d97928a4d600922ca5a1db8fdbf9b82830e4bf6bc8669cb5420a2df9489645d

SHA512
8811315f3635a839f5397db82339ce4e7a54296a0433ddfaeae6164a5534377e6964d3ad5c74586c28119fd53095bbe5feb48b131e6a97bf98df6f6fdecf9093

Download Submit
/storage/emulated/0/Download/.pending-1727964536-Hello Neighbor_2.3.8_APKPure.xapk

Filesize
823.5MB

MD5
470a560845a8cc8f28f1709a31e4a069

SHA1
ba56f74b574c18bb68e6108686616060a88a8c4a

SHA256
a5e416002c8d5b4efb3cad5e8539f24e353809afa7dd34c20316fe61f134fce1

SHA512
fa26182030a4dd8efd6b1b8df1652aa5967b6b4d27df78e2b7e119fbae0e7aeee4054e1471c4e8e1b44d17866062b0ad211ab6b6fb96957a7777a35c082d0801

Download Submit
/storage/emulated/0/Download/.pending-1727964536-Hello Neighbor_2.3.8_APKPure.xapk (deleted)

Filesize
543KB

MD5
0fcfc2532da0e64c336d0a4822affbed

SHA1
6c167d8d9c619e15ed4c318f0f81c122d738f2ef

SHA256
cf801b4b1b66667a9a9230d115911f87382514014364249445486afaffcd8048

SHA512
8ab6e3db4657a6021681004f7c0a5cc83964a552ae225e3c46220fa471d8dce5bcd1d5f65a1cd6f10c765f562cf580a27de93649154a61a7b84c928dd5c4c04a

Download Submit