wipelock | hxxps://web[.]archive[.]org/web/20230706214541/hxxps://download1587[.]mediafire[.]com/t1vdad3xufngg6CCX1k5jtiFJ0YYnHArLuX2ldpUW45Y7C5_ICaaMoj15-uYrQ6IH4D6uZD0Xn-dcHnvDAXCw1fpmTc_0gQtEgldscAvESOiKjQXCpk1VPUISW0N9EJwVOMwZfG74yKr06krisXQH9u4s95Hp7LFqY-oMYQYAG2yBcY/12o45hf43lvv6az/fnaf2+aptoide[.]apk

Resubmissions

06-10-2024 01:21

241006-bq5lsstamb 10

06-10-2024 01:05

241006-bfz9bssfqd 10

Analysis

max time kernel
124s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
06-10-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://web.archive.org/web/20230706214541/https://download1587.mediafire.com/t1vdad3xufngg6CCX1k5jtiFJ0YYnHArLuX2ldpUW45Y7C5_ICaaMoj15-uYrQ6IH4D6uZD0Xn-dcHnvDAXCw1fpmTc_0gQtEgldscAvESOiKjQXCpk1VPUISW0N9EJwVOMwZfG74yKr06krisXQH9u4s95Hp7LFqY-oMYQYAG2yBcY/12o45hf43lvv6az/fnaf2+aptoide.apk

Score

10^/10

wipelock infostealer trojan

Malware Config

Signatures

Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Wipelock Android payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-5.dat	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4456

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
2KB

MD5
1fccfab94e4c69df6c79b669f2a88148

SHA1
87d262c0a470897eaba2fb334920b64877c0812a

SHA256
9b5bd0d464ed59eda7aaa140fa71fb3e8237bee28b554a9b0647708af5b71333

SHA512
444e3b17ba162a8157241ab237cdd097cd96988dbc7e4a677d91d41dde5ba6acb6416572d80537df0cf29f658250f30d8369ebcaa924408911e96d8852d6018e

Download Submit
/storage/emulated/0/Download/.pending-1728782533-fnaf2 aptoide.apk

Filesize
549KB

MD5
62056e57d82edbaeacbfbd770d33f853

SHA1
d0c0ccb171d9ca4a3cd65a71805fe35f1bcd197d

SHA256
7d1b0708e8f41e160362a16e3017ee5b98a1260345b51d72d0e75b5ee8ac17ab

SHA512
382756b026bfde1249c94a2a11957e2955c46844e780b506e2ad762547f3de8381f0f6e8bf1a7c9dbede846a90531a3168bcb41a8816cc9249e43e556cb15d46

Download Submit
/storage/emulated/0/Download/.pending-1728782533-fnaf2 aptoide.apk (deleted)

Filesize
541KB

MD5
e353795658248b84a9031faf916e099c

SHA1
fdfcceb08cf1c749e468421db99ecb36e8af933d

SHA256
23f4243f96d622feb3abc23f78d49b629d38f8ec5f597c6a2b363969a06e87fd

SHA512
9843562017c958523a672fbb237fcc44f227af808fd2b5ebd7a498ec0f88fdb84aedee8a933e688be801a8edc66dc334bda13ae500d5d578f08313f1ea0fb1ad

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads