d77d9242bbf4594277b96ed9af5f2fa721b82c578d0e0c640f42928ec8002257

Resubmissions

05/03/2026, 19:15

260305-xyamaaax3z

05/03/2026, 19:10

260305-xvr26aax2v10

03/03/2026, 14:05

260303-rd357sat3x10

Analysis

max time kernel
140s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260129-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260129-enlocale:en-usos:android-11-x64system
submitted
03/03/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BotWhatsAppAssistant.apk
Size 197KB
Sample260303-rd357sat3x
SHA256 d77d9242bbf4594277b96ed9af5f2fa721b82c578d0e0c640f42928ec8002257
MD5 a14e9bfc6dfdfa6fca36a7aefe7590d1
SHA1 e7781b298b4c41d858d0cbbc7c1f41e23362cac8
SHA512 e4368a8710ceb36a375a5b06c5c2ad218b22e47966560d9980be22b370d4ac7ba0d929199b0c9f37cc255e3627330d6c641c76f9d5f2021e80a7b2e407abae88
SSDEEP 3072:9ao9gotnv3rKWXwZs+gmiPYUg4/XVJ2bqfAwXuO1Mz6k7mp1wEpi61eu:9ao9gotTRusNk4PQVv70dp7eu
TLSH
T1861412665D8634E4DEBB07B4DF7AB0D46A44EC53A06EB61D3024B83D1D70B8B235F8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.playaddonservice
/system/bin/su	com.playaddonservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.playaddonservice

com.playaddonservice
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
PID:4927
- getprop ro.product.cpu.abi
  2⤵
  PID:4975

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 bcad604bb56bc973470692dd56314c7ce3a440c11ca09423f6d1826973fbc7cb
MD5 f1ddf1dc91b24110ff6a8097203db831
SHA1 97fd8d21c3880de50ffcd2d27a72299eb8fbea99
SHA512 4ce19ccf718a82dc5ad563ff6b4f3280f667859886e622d729fdb95dac421db1026e40a5be78712f422cfad8b5c0c21a70eebcd7a717b0757269b50417464a60
TLSH
T1A5B012E0F4A8DE1336C00D1A44309A4DAB763E83959534E99C27E8358EFA1420264091
MD5 SHA1 SHA512 TLSH

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
TLSH
T171A02280C0FC8820A2C002220038C80C23323EC3003020C00C2088380A8820208000A2
MD5 SHA1 SHA512 TLSH

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 70b51345c830fdf5a8088944398677996c1bb8f498366e2c3535fdfe6866da6a
MD5 7f60f88838a9ff4bec90e173cb9e0db7
SHA1 96d5af7f34860234a5923cd9b6bcc11340c868a8
SHA512 c92f26f0bf1a8bb492105ea3598999666a3d80b2c284ec12579510a2852f6b5ae6bba0a3e20045c26252ec14cdd76fde493d077f52c261572302c73e4cc5b25c
TLSH
T1D1B012D0E8E8DD2336C20D1E45309A4D27763F93959534E85C27E8398DF634202500E5
MD5 SHA1 SHA512 TLSH

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 408B
SHA256 5d44e45cfe3d08b5086cde7610172d43f2d53ef8c879cfcc2e07b6b3bc74b88e
MD5 502fd7530fcc175fb1bf6c1b663bd6cf
SHA1 41ec48dcf63cb3902ab0270abda3edb67fe5a459
SHA512 8b61c5a2c570b8f0691ed11f41fcd42d04866d5f51674fef47d5f6e2ec89629390fd2c627ffb4de3b621c750a522a581ffa2c003e16ca613169a975dd1f03135
TLSH
T1EAE02B80E99CDE153C903F3608B0A1881DB83D77627A31F8E0DB7014CC598021571A90
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads