triada | e1843b41cbb9b8b86b9c4e02aeec7e14dae18d56ca51458e1ffd3073f143246e | Triage

Sharing

General

Target

KB4WhatsApp_V37.apk
Size

87.1MB
Sample

241030-n6p79sshjc
MD5

a9594201e781c680930903e318496813
SHA1

a4ef13a1180325bbf5c3a672530b27fdf824902a
SHA256

e1843b41cbb9b8b86b9c4e02aeec7e14dae18d56ca51458e1ffd3073f143246e
SHA512

7888501b6695f73650f691ef4612693aae91a6ed9705aab29626a34a0033f9e2ccfb679dbb593566016297af569f3e6ebfd9594d145bba21b1850ade501d34db
SSDEEP

1572864:DegBSwAtm9SffSs6ILx6S9BE22s08xGPm7d1dDR5K4oRjxxuKsr2:PcpcWLxfEJs08xhB/DRgxxuKh

Score

10^/10

triada android discovery persistence upx

Malware Config

Targets

- Target
  
  KB4WhatsApp_V37.apk
- Size
  
  87.1MB
- MD5
  
  a9594201e781c680930903e318496813
- SHA1
  
  a4ef13a1180325bbf5c3a672530b27fdf824902a
- SHA256
  
  e1843b41cbb9b8b86b9c4e02aeec7e14dae18d56ca51458e1ffd3073f143246e
- SHA512
  
  7888501b6695f73650f691ef4612693aae91a6ed9705aab29626a34a0033f9e2ccfb679dbb593566016297af569f3e6ebfd9594d145bba21b1850ade501d34db
- SSDEEP
  
  1572864:DegBSwAtm9SffSs6ILx6S9BE22s08xGPm7d1dDR5K4oRjxxuKsr2:PcpcWLxfEJs08xhB/DRgxxuKh
Score

6^/10

discovery persistence
- Acquires the wake lock
- Legitimate hosting services abused for malware hosting/C2
- Queries information about active data network
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Information Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence