wipelock | d506e42c3a94132d53325e44976dc0f28a2f4ec6cde093cf7deef88b5ff85a5f

Analysis

max time kernel
78s
max time network
149s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
27/02/2025, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fnaf2+aptoide.html
Size

12KB
MD5

23fe1cb91095e334bb565d3f606a0575
SHA1

a002a080f6dda4fa397121e765cd298ecc87a193
SHA256

d506e42c3a94132d53325e44976dc0f28a2f4ec6cde093cf7deef88b5ff85a5f
SHA512

c21f29ee60a40125719926ca964ff259eb352bcaaef5662e22f6867bc77f7133deea400d36b89e36d0152c41b75d29ac8866a3ea7ef7f5fd27b47ce5a85e89b0
SSDEEP

96:gY6KH7g5UKgbbaHMLASWbDQkMbDduWS5z5b3pybp77b8udJ6/k3bDBubKdbhS3CL:BvaUiHVy2L5zhpI7s29Iy7HLlw8

Score

10^/10

wipelock infostealer trojan

Malware Config

Signatures

Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Wipelock Android payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-5.dat	family_wipelock

Wipelock family
wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4339

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Download/.pending-1741286244-fnaf2 aptoide.apk

Filesize
549KB

MD5
e5f83321943debadad7123961692528d

SHA1
5c59fcc37f0d2ec8fbdd9bb45115d40e311b369e

SHA256
e26ad6a4844f09249ad6115ab638c5351b5a6846c02a769fb3de9e48c2c2dbdc

SHA512
6eef6aef2c1490606a8c1c0a1c6b7c0814b6e81dd23b25b3239b850f4cfe4078228d5a8428b17aec26bacc538dafb443f0986315a3afbfb9df0dca307accee74

Download Submit
/storage/emulated/0/Download/.pending-1741286244-fnaf2 aptoide.apk (deleted)

Filesize
700KB

MD5
1ddd1fc168b2cd328d7111acb918d665

SHA1
428898d79bc059e7dd5c3e1199d6668ac5e10160

SHA256
989472134567b27883a308ed4c8e0a6f690c74d1ae4e35d2fe9acfa95c54ef0c

SHA512
d517a57d307981d770424d63fc9352dddfb12057690dffa819422610cd4a8446b872454d97316c0292f6ee12cbc58925b46e72c592a18d0d0fc4dacf44863f11

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads