cloudatlas | 21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

General

Target
21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479
Size 1.2MB
Sample260608-wscc9ac13x
SHA256 21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479
MD5 046a3e7c376ba4b6eb21846db9fc02df
SHA1 f27571f4967fe120ed267ca1def42bd467f2d40a
SHA512 295a7f954325c1772b17739b1f5e7a442c465307ffe21e5748c3a0660ebd0f2af01b929e9e092284fe86f96b13288be098fa52d3fd798aff304d4fd5487fb7c4
SSDEEP 24576:8BgpApBDUSYB78qZLn3raJuqj04OAVFIM6MVnEXdDMfep5sDSjrOLWHmRnZlWL:8BgkDUSYfZj3edVzDJ81MC5RHArlWL
TLSH
T12F553362BAFBDC4FF56390F82BE540152355F9CADD35301E5219B329A8462260C7AEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer rat cloudatlas

Malware Config

Signatures

Family: CloudAtlas
An Android RAT used by the CloudAtlas APT group, also known as the Inception Framework.
trojan infostealer rat cloudatlas

Android CloudAtlas payload 1 IoCs

resource	yara_rule
sample	family_cloudatlas

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

File Explorer

21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

.apk 1.2MB

21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

SHA256 21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479
MD5 046a3e7c376ba4b6eb21846db9fc02df
SHA1 f27571f4967fe120ed267ca1def42bd467f2d40a
SHA512 295a7f954325c1772b17739b1f5e7a442c465307ffe21e5748c3a0660ebd0f2af01b929e9e092284fe86f96b13288be098fa52d3fd798aff304d4fd5487fb7c4
SSDEEP 24576:8BgpApBDUSYB78qZLn3raJuqj04OAVFIM6MVnEXdDMfep5sDSjrOLWHmRnZlWL:8BgkDUSYfZj3edVzDJ81MC5RHArlWL
TLSH
T12F553362BAFBDC4FF56390F82BE540152355F9CADD35301E5219B329A8462260C7AEFC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android CloudAtlas payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

0c77471e1e1c7e397883880525948c1b9b883650

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Medison Aniston,OU=P$company

Chains

Jan 1, 0001

com.whatsapp.update

Android Permissions

21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

Permissions

android.permission.GET_ACCOUNTS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.ACCESS_COARSE_LOCATION

android.permission.INTERNET

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_INTERNAL_STORAGE

android.permission.READ_INTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_PHONE_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

com.android.browser.permission.WRITE_HISTORY_BOOKMARKS

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.READ_CALENDAR

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_CALL_LOG

21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

File Signature issue

com.whatsapp.update.main.MainActivity

com.whatsapp.record.RecordService

com.whatsapp.update.main.TaskExecutorService

com.whatsapp.update.main.AnswerSenderService

com.whatsapp.receiver.NetworkChangeReceiver

com.whatsapp.receiver.BootReceiver

com.whatsapp.receiver.OnTaskUpdateReceiver

com.whatsapp.receiver.OnFileSendReceiver

com.whatsapp.record.CallBroadcast

com.whatsapp.record.OutgoingCallBroadcast

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479

File Signature issue

com.whatsapp.update.main.MainActivity

com.whatsapp.record.RecordService

com.whatsapp.update.main.TaskExecutorService

com.whatsapp.update.main.AnswerSenderService

com.whatsapp.receiver.NetworkChangeReceiver

com.whatsapp.receiver.BootReceiver

com.whatsapp.receiver.OnTaskUpdateReceiver

com.whatsapp.receiver.OnFileSendReceiver

com.whatsapp.record.CallBroadcast

com.whatsapp.record.OutgoingCallBroadcast

Android Permissions

21b7ab52098b8d3f90f6a36362cba6a68967ae318b07e3ac99757d2d21ba2479