triada | hxxp://gbproapp[.]com

Analysis

user interaction
yes
max time kernel
36s
max time network
85s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
03/05/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gbproapp.com
Sample260503-scprvsbx21

Score

10^/10

banker triada infostealer trojan

Malware Config

Signatures

Family: Triada
Triada is an Android banking trojan first seen in 2016.
trojan infostealer banker triada

Android Triada payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_triada

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4317

com.android.chrome
1⤵
- Checks memory information
PID:4797

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.com.google.Chrome.2wZ4JS

Path /storage/emulated/0/Android/data/com.android.chrome/files/Download/.com.google.Chrome.2wZ4JS
Size 13.2MB
SHA256 1f3b2fe707899dc7d510556c3c535b19ea530eda747e424c7570dfec8427311f
MD5 580ea773120fd2d37933b45956a9ae98
SHA1 576617f91c761e57e2bd0c10568b86eab4224db4
SHA512 ccc74b4d177b18666dff45a83d5e111ca9f47a5590af47f94e29d5e08adec65a0662f95797e544f684fd8231d26a6ee419798ed1585c946b0b527dd48428ba9d
SSDEEP 393216:cSSXbUKbwwrm/rMNCl5CY1UurZKQe/3gn:cSc4KcbuiCY1UWe/Qn
TLSH
T127D633DCC243AE95F081EA7F34A00BA57FA5CB416131A3735B4E01A9ED2EC48F5D9A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pending-1778425175-GBWhatsApp-50587760.apk

Path /storage/emulated/0/Download/.pending-1778425175-GBWhatsApp-50587760.apk
Size 94.9MB
SHA256 bfa1cd1f212b5a06f6eb66a44b7a292fa542ca7e10313e95f136c29d8648e2a3
MD5 636a1cfb3920219cac3c3a9f4c72ec3e
SHA1 37632887e7afdf25f9ca15799a797aeffa771820
SHA512 ba65676fdcb2007a48f99de4931c61691f3bdc99dc178a4f448a9831933e71c52dbfed2d91badea21b1b617c402b5801700cf76f092bcd372b4db9e5b2d09ef8
SSDEEP 1572864:nJ/FGi/eFb3r9kn3IMZQtS7g7AgRd4w0oMuuVOch:J/tedrI7g7AgYNoM9wch
TLSH
T16628228AFB8EDC1EC5F755319B479BE2651D4E144A41A6DB2B00320D2877EEC4B4EEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.pending-1778425175-GBWhatsApp-50587760.apk (deleted)

Path /storage/emulated/0/Download/.pending-1778425175-GBWhatsApp-50587760.apk (deleted)
Size 13.7MB
SHA256 514dd58fe9f01dadbe7518724643bcf7e53e7bdd98f59d384957f3b55e14fc2d
MD5 9be089da2e899b9c6ad0211a0c5672cf
SHA1 74e826d48d69f7dce33db8a80c0c5d6b055a6289
SHA512 2a3cca14d343897016a4a908996b1311487ec3cfce0cb4b1a264f1be1b54b64780765416e1fce5d9f430f0fc3655b826791ac8a6de4f24137462e211c567f74e
SSDEEP 393216:cSSXbUKbwwrm/rMNCl5CY1UurZKQe/3g:cSc4KcbuiCY1UWe/Q
TLSH
T1E7E633DCC243AE95F081EA7F34A00BA57FA5CB416131A3735B4E01A9ED2EC48F5D9A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads