triada | hxxps://fs391[.]tbx[.]su/files10/2000108_396c9d/whatsapp[.]apk

Analysis

max time kernel
1798s
max time network
1807s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
27-09-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fs391.tbx.su/files10/2000108_396c9d/whatsapp.apk

Score

10^/10

triada banker infostealer trojan

Malware Config

Signatures

Android Triada payload 1 IoCs

Processes:

resource	yara_rule
/storage/emulated/0/Download/.pending-1728066680-whatsapp.apk	family_triada

Triada
Triada is an Android banking trojan first seen in 2016.
trojan infostealer banker triada

Checks CPU information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.android.chromecom.android.chromecom.android.chrome

description	ioc	process
File opened for read	/proc/cpuinfo	com.android.chrome
File opened for read	/proc/cpuinfo	com.android.chrome
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.android.chromecom.android.chromecom.android.chrome

description	ioc	process
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4348

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5173

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5412

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
56B

MD5
cecb649cb1fb79c3736936fcbef3bbf2

SHA1
2c95183d7d2b0cd68d15b3c4115189351fc08720

SHA256
09bda72e7c32a69e3268e0ebd8caa33684cbc954dd00c7d93a38830e348ef324

SHA512
b8aca3cf0ea838093bd29b70ead608597260b0e35886d491d17c304878f99510fd885d96a191080acb5b706a642253bd9cbe5065ff234472b048fcce282061de

Download Submit
/storage/emulated/0/Download/.com.google.Chrome.KTsLUe

Filesize
90.1MB

MD5
5f3214680606504eeffabe94c8202f29

SHA1
19e92b68d34bd134f6555b8735c969e3658e30a8

SHA256
4dcace82ae85323a0da12d0e46f5695c52ec7614af7291528ec95cd39df1ae4a

SHA512
6b9a2d3c804ffee7b1b0f38f5e50a2305a3850d54fd7248b60d261dcde7a88a2169222c7f3685232a9b73fdb74f0dc2fd646921dfffd7200f2f76cbebf7213e4

Download Submit
/storage/emulated/0/Download/.pending-1728066680-whatsapp.apk

Filesize
99.3MB

MD5
69906fe70fdb1727e0746374c4161f32

SHA1
6dfd071549d6b48806ccb2ad7ab5946fb756c8d1

SHA256
30ca3ee7a5b6fc774e63919f51ae7d66f74d9220ecf498c3b9266756a2b82fa0

SHA512
940a8c0c6f5241988f5896b2a33e0329d3f11cfa2e353c291b56a0c51ccb3e7808e56ae8e42de2dd88ad1f79ce05f1b4d9d5485e54298196ebd56c418af2d5ff

Download Submit
/storage/emulated/0/Download/.pending-1728066680-whatsapp.apk (deleted)

Filesize
2.8MB

MD5
1026ce6a113a6d8f00cf98d9210b078c

SHA1
792ddfe1ded0ab53b4a11a33544da5d0a563df01

SHA256
6589fc57723c1ff3c1dc3a53f4b06c4d6b6400ddb21620d7b7cbbee317527bcd

SHA512
3836851460bc2a3f39c6646de40cb2e21200dd933832e834a805b95193258fa3bf91054e0360f4e6631c229d97e45e0f4d0f2e7857dbddd366455ce1a8f3ac63

Download Submit