087988a6259e8fd826f8cd54ea22f12c74037eb00b1ffcfe9e8473def4fd06d9

Analysis

max time kernel
10s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
05/01/2025, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Whatsapp-gold-v39.00.apk
Size 85.3MB
Sample250105-2g2fwszpbl
SHA256 087988a6259e8fd826f8cd54ea22f12c74037eb00b1ffcfe9e8473def4fd06d9
MD5 cfeb62a7a0106ceecafe9fbbe13fa444
SHA1 690b71675b9331f35a0bc88d50e28e03354069e0
SHA512 180db60f94cad1e0707ea593a4547bfa89c43a4d5eed6c2541fab1efa7185341cf2e9712c8844b1e4f1d6bbbdadf4ff373c55997a0d5d8cd435e5b1f51c655e1
SSDEEP 1572864:+ZCEKEu51mcWvgekZ+VwZuKh2s08xGP52hG7d1dDR5K4oRjxXB:+1O1mLoeDGuKss08xjhGB/DRgxXB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4381	com.WhatsApp2Plus
/system_ext/framework/androidx.window.extensions.jar	4381	com.WhatsApp2Plus
/system_ext/framework/androidx.window.sidecar.jar	4381	com.WhatsApp2Plus
/system_ext/framework/androidx.window.sidecar.jar	4381	com.WhatsApp2Plus

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.WhatsApp2Plus

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.WhatsApp2Plus

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.WhatsApp2Plus

com.WhatsApp2Plus
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Checks memory information
PID:4381

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BTOR.DB

Path /data/data/com.WhatsApp2Plus/databases/BTOR.DB
Size 20KB
SHA256 63ccde4cb62894420110307fb114801ed6ea591182334a2c564187d7987648cd
MD5 6365b8be8792f9d6cdf02b86aac88673
SHA1 e9ea1b6b1db7bb348cfb63357c451215e2c016af
SHA512 d53f6cc31df48c5ec099d7ee96465071aeffe2f1d06d0e31d9f326ebf846f72a5d4d7d1833999c5c7cbc36410a6422e0a7ea4411aaea9c75c7e55ef3eeee373c
SSDEEP 12:TLbyNTSFbyfDx6ayXwkwfb92k+E+mZQRmBEyPbAVOwG:TLmFDYgR+0zGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

BTOR.DB-journal

Path /data/data/com.WhatsApp2Plus/databases/BTOR.DB-journal
Size 8KB
SHA256 ba219aa035a8ddae2ff82dfc0e8c10187cee6f6dac907ed81f58b3a4478f9267
MD5 af487d827bb220eafccce09db4dc46b6
SHA1 32ecc552de2402861afcec0992f8d656ecaf41ce
SHA512 ef7cf3d51b44b903cc915f690d057c16062b466a752fd87f453321855d0c5fd405e33eedd845792473ff865f23c2254a7eeb3a67c61de8c0c5e8360611ad941a
SSDEEP 6:7+/l9WUn1e5pg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKeu:7+tUzqLiuWd7RmBEyPbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

BTOR.DB-journal

Path /data/data/com.WhatsApp2Plus/databases/BTOR.DB-journal
Size 8KB
SHA256 1b88b8d66c5e177398efde52105e97721a370fed2e4274ddd6a80615bac83948
MD5 651a3f92ff6b0f5d4276b8d493d3e02b
SHA1 fab0f94e6d17dab226c5de026d60512e61da8629
SHA512 1dedec1eb84e7f833210800e8492c4b0ccbe42fbeea92fb67e006671ea724f0921857f511bdbde6d3542d792199d4b36804ed2bbec5ae237018c505527de6bb7
SSDEEP 6:7+/l9zFPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKKt/6:7+trqLJdKBRmBEyPbH16
MD5 SHA1 SHA512 SSDEEP

Submit Download

BTOR.DB-journal

Path /data/data/com.WhatsApp2Plus/databases/BTOR.DB-journal
Size 512B
SHA256 3ad87386ba1c2af6c32976087bf70ee2ee666a5972e38699a5a81acdc099e21a
MD5 7b8633c530aaf7e457a3a2e2ef8b4a6d
SHA1 a61962ac5ebbcd93b8c131dfd740aca3a6c3d46d
SHA512 a6d638983cde27b000a1d8968e6d64aada270bba6f099db632b91b38b0a6881b0cbbdbfc86d61f813920a98463d0d8a66cd581924f64ce92edc218ffa5be9964
MD5 SHA1 SHA512

Submit Download

EHS.DB

Path /data/data/com.WhatsApp2Plus/databases/EHS.DB
Size 20KB
SHA256 fdb4a80bb6a82170b194773754f858b74915ae61cf6995ccf149f55b167c7b28
MD5 b48f7ffd789fab6a4600554e8c474935
SHA1 6c6896fd3437878a91b014c74bfe2b2c83c2b4ee
SHA512 43802b7b7adafaba9231d0aac2fc659461c2f3f71cd0e89f5bf1ed54535866f6700364b9a42a269dba0346987cc8a47c031edf8709ee5543ff17aeab82148403
SSDEEP 12:TLYQyNTSFby/cX4N9ARAdUDAGRmBEyPbAVOwG:TLGl1AqUSGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

EHS.DB-journal

Path /data/data/com.WhatsApp2Plus/databases/EHS.DB-journal
Size 512B
SHA256 24bebb9aa0f502ac49af16fd58feb38e5f4c1969afbb80bf4856cb359955acb4
MD5 bd14281d1af10019654159008e341fdf
SHA1 11c856e07787294d2121487212af79d5030bfd35
SHA512 992c93ffe020722eb6995e2455f91b12c10f735518cbcce33351dffee32f744ca45eb802983acb16b5e5cdd1002ad9f9a6cc18ff8aff24b66895e5b7b4d7b9b7
MD5 SHA1 SHA512

Submit Download

EHS.DB-journal

Path /data/data/com.WhatsApp2Plus/databases/EHS.DB-journal
Size 8KB
SHA256 2d14c5bdc47b889aa55b193a5f6681d4587d7aaa9d968c1bb57080b274a69789
MD5 72134abcdb9b601c46f817f88dc8c90a
SHA1 58effcb78ab2bbb951ac2c84b6df9b82e1bbed01
SHA512 98cb5545dc9334407697fa5a096368e9556797760ff74e9546f58f9fdf6b3d34fc5d7b805538280f354a0d957b9365d603cc6ea6374c61f32edc8a9d1cba8df4
SSDEEP 6:7+/l9a5On1CDg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK5:7+tcZqLiuWd7RmBEyPbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

EHS.DB-journal

Path /data/data/com.WhatsApp2Plus/databases/EHS.DB-journal
Size 8KB
SHA256 29385a7c8032bf6ba7efa522dfab89b51bb462118d5868b04c1ce57e47ffc05d
MD5 e747b0c2bffc59404813fcc1381200a5
SHA1 ad1cbfed8df14684a194cc9d58d22abc1124beea
SHA512 d0e896be3d5bd601c6fe01106b3643165e7f1057abb92880aa5c2244efb318c7c14387470e26937d01fdf1556b6298bdaa53c42c99f86020d231358d3bf50e21
SSDEEP 6:7+/l9KxPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKDb/r:7+t09qLJdKBRmBEyPbsr
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events

Path /data/data/com.WhatsApp2Plus/databases/com.google.android.datatransport.events
Size 56KB
SHA256 6f21cb73bc4812b84937feb60616a2127ad9b9538fe1b4439948ac3eb9cf7327
MD5 c8e97bde9056ad8eb1fcb879d0b7f05c
SHA1 7305b97916939903cb1cdb3344e5b9a9175f81e5
SHA512 cf76b119841de2c88742065ddbd431090f981736f276062553bda28853bb60792a69fc969e631a91ba25f86fbd7777ca33f05964f23204de38f068c13e153c17
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSI:RMEX0wIyNjaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.WhatsApp2Plus/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 fe4587fe794d3ed74f553f65749af47c007db7abb1d0d448dfd09ec69da8c26a
MD5 fe3c3a0d5a3df2856d6fee24db75767a
SHA1 27c690133ed831e815115349e8374d7e73e0cb02
SHA512 a098a975cc0ed4392d63d472258e302e96d952c765db9ab2360799f5978c589f5545185439c51a6257f67bd4375f507f23780da32255a89345ac2750c09586e3
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.WhatsApp2Plus/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 11400ce456e8d4ca56481d3a9f93d21dfc4916d8729553783978021285ba389b
MD5 3989cc8590d55ce5004534afda06f569
SHA1 5c18e28dae6e2af072adc025f8aeb4d3a5603fbe
SHA512 7b50de6ffdd706b058bbfac6d51cd29181c1efc01537c0e4c63dfcd44f169c30ee9ddff4a3fed4fab4723cd27911cb3e365b6d67304ed9978af5e49caf7bc781
SSDEEP 6:7+/l9B6zHn1U/4W2vg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKm:7+t2G/wqLiuWd7RmBEyPbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.WhatsApp2Plus/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c67b8dd9a83d6da9bf27ca85e076b446825003e5b7d18bc61cfda7fd4720441f
MD5 81303543d6a223d10dc77f1fdac5de44
SHA1 49b8200066020e0d19aa94d92546fd5ba4813cc4
SHA512 0fc6cc5f783d16979f4cbc5948d05d828a91a861909f4dc7a06c6d827ba39032c387f5cfea1be147c6f98344f6507f11e3c68dc15f8535a25a086f3a32236f40
SSDEEP 6:7+/l9BaS/gPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKSnM//:7+tei4qLJdKBRmBEyPbrs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wa.db

Path /data/data/com.WhatsApp2Plus/databases/wa.db
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

wa.db-journal

Path /data/data/com.WhatsApp2Plus/databases/wa.db-journal
Size 512B
SHA256 38140596ef3d2bdf737674bb5a81681215b0fcd89fd445bffbb6600ff8f412bc
MD5 eaa23c8eca8fb964c2b77cd10d11b907
SHA1 e18385eb84e58e4f674ff62436fd7340d8418321
SHA512 701bf5ffb53b27c23b484e035c3bab1eace3d23b05fef4ab220ffc2e756430f8bdc3a30615d37277d63dbc70cceb91e14c22ad4f36bb725dd3780a066e7633d4
MD5 SHA1 SHA512

Submit Download

wa.db-shm

Path /data/data/com.WhatsApp2Plus/databases/wa.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

wa.db-wal

Path /data/data/com.WhatsApp2Plus/databases/wa.db-wal
Size 16KB
SHA256 c93be82f450bbb2d6a863670de12ed4fdee9d6b34c24df8c85f69e3907e05d91
MD5 6f761757f54d79b2855a0684186a92be
SHA1 bfb7d84071d910bbc1b96a3174351208d01c96a1
SHA512 e6f076485a8fae691acbd80d1ab254da727048a105cc77c530eb8594f88bced130afd763d386d416865c82d759541c012bb9d9279108402fb4a5a1fbeddefb43
SSDEEP 6:K69cy9FZdKEAlOERX4PBX4ogLugMBX4suuK+/Phl+fheQb+fO4Ow2:KW1zdKBRmBEyPbP/P6fRCfO4Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

whatsapp.log

Path /data/data/com.WhatsApp2Plus/files/Logs/whatsapp.log
Size 5KB
SHA256 b5a30fb921560db871fe180bbe05c4c8ea3484d77699da2af1f04f90bf8d192e
MD5 80292a9416c28eaf237c40cc4acae17c
SHA1 9766e16b1c9bb2e21e294b04bbb117678b585bf7
SHA512 9b9df30527e242524d2c04e6789d9ac8836b206fee1632563222bfb73b37def46235f28de187f58e04fb240dc60c5e20d976c71117ad53cdeeddc6b11888b4ab
SSDEEP 96:kE13ZXeeoSfe0bkjo3C3+en5XMSI98eyM9QDUHlJEdzPTCh6mh63unyh6W:kE5ZXJXbt7JDQYHlJEdzPT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation231738034736150816tmp

Path /data/data/com.WhatsApp2Plus/files/PersistedInstallation231738034736150816tmp
Size 90B
SHA256 c8ed2e59736691a97b258bc25a57333139f4f7e5d81627d4ac77fe9391c88f16
MD5 eef5552ebd2889881ca32c3a32e5fb8d
SHA1 8c0714d2520df990b6c45a3ced0ec59e2aece53b
SHA512 0030bb97038a3725a3f30442e350436fdc847674e2b580eeaf3a93e41fcf82f1f2c898d56e1e3cffb3a1df09a3ab665a8ae81c853d921a686ab8e74b3ab4779b
MD5 SHA1 SHA512

Submit Download

PersistedInstallation7437628461704486465tmp

Path /data/data/com.WhatsApp2Plus/files/PersistedInstallation7437628461704486465tmp
Size 114B
SHA256 a55ec61e3ffcbc17faaf80f4b73b20c183d33724ef278546984df2958e0f7f4c
MD5 acbd4fc4725d56391353c4ba80b23a67
SHA1 664f41423b36c588c3420e6dc076e136c35efc7d
SHA512 5746fbfa66a5c941e0d6feddae44cdb0c7fe35936348ed5ce9cd95a52b9be46e894e299fa7ac8db5690666df2410aa8eab150f141bd4ec38ff38861138e2de37
MD5 SHA1 SHA512

Submit Download

.superpack_version

Path /data/data/com.WhatsApp2Plus/files/decompressed/libs.spo/.superpack_version
Size 31B
SHA256 2531a0318285ac94b0582dd4e45b15ec0530f41a79cb581bb99d94452812e90c
MD5 6b76fe128799983e3293bc2e257b47fe
SHA1 ba097e207e24856cd13e4a446dd93952af81c624
SHA512 a3b1cfff2969eaf56d20d158f18c65998da6fd749de4746444a24725548dacaa579030ff0c0251f6f01ced399d656bae8804cf27230a4bdb1a91e7791f5a766a
MD5 SHA1 SHA512

Submit Download

dso_deps

Path /data/data/com.WhatsApp2Plus/lib-main/dso_deps
Size 396B
SHA256 8bf0848c029e7a7c428ccfa80608481fa366f50a9ac702d132c0948109eb9f23
MD5 42644407df8a353537d5d92f066c3b5e
SHA1 de70d8e75fca7ca06d6d89e1e3c42b0f5f215b50
SHA512 b3b2c5c6a16c6871fbd66b95489efc2c4fb8c2383ce93944da9f02b6f33126d1026a2d22fd6caa70d9a34ecec184faa021a9f954c526f34e3fdc4dad2fc1a80a
MD5 SHA1 SHA512

Submit Download

dso_manifest

Path /data/data/com.WhatsApp2Plus/lib-main/dso_manifest
Size 5B
SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.WhatsApp2Plus/lib-main/dso_state
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

dso_state

Path /data/data/com.WhatsApp2Plus/lib-main/dso_state
Size 1B
SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
MD5 55a54008ad1ba589aa210d2629c1df41
SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
MD5 SHA1 SHA512

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
MD5 SHA1 SHA512 SSDEEP

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads