Analysis
- max time kernel
32s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
26/06/2026, 08:37
General
- Target 15e47dc5e3dbff650db31879bc7269da49c3a865a402cd826e234cf7fabc0325.apk
- Size 945KB
- Sample260626-kjamhsax2k
- SHA256 15e47dc5e3dbff650db31879bc7269da49c3a865a402cd826e234cf7fabc0325
Score
10/10
Malware Config
Signatures
- Family: Viper RAT
Viper RAT is an Android RAT first seen in 2017.
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Reads the contacts stored on the device. 1 TTPs 1 IoCs
- Reads the content of the SMS messages. 1 TTPs 1 IoCs
- Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
- Reads the content of the call log. 1 TTPs 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads device software version 1 TTPs 1 IoCs
Uses Android APIs to read software version number for the device (IMEI/SV for GSM devices).
- Reads information about phone network operator. 1 TTPs
- Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell information.
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.whatsapp.updater1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Reads the content of the SMS messages.
- Reads the content of the browser bookmarks.
- Reads the content of the call log.
- Queries information about active data network
- Queries the mobile country code (MCC)
- Reads device software version
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v16
Discovery
Location Tracking
1System Information Discovery
1System Network Configuration Discovery
4System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
CI312456789
DI123456789
LO712345689
TI213456789