Skip to content

Latest commit

 

History

History

SHIBAI_campaign

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 

Nice chatting with you: what connects cheap Android smartphones, WhatsApp and cryptocurrency theft?

Samples

All hashes are SHA256

WhatsApp.apk

sha256 Package name Detect name

686eddfc03387ab7ccaa6ae0e02c0a1977c242c680d495fccc5b1c124440f650

com.whatsapp

(Android.Clipper.31, Tool.LSPatch.1)

fbb8d4a58a40de45b3178b7cbe580e7c601e8542dac45f8d2d95415d5ba4c86e

com.whatsapp

(Android.Clipper.31, Tool.LSPatch.1)

ebcec9c32d6d8b5f83b4e98405cfe31b7816022574205dea289d4f8ac27f9dc8

com.whatsapp

(Android.Spy.5745, Tool.LSPatch.2)

cf955b81396f7b5f8d6d3d3768fd050a1188fd8456105c7f8100dfe50a6520d5

com.whatsapp

(Android.Spy.5745, Tool.LSPatch.2)

665174dfe58837fa4d5e19792caceba7db236c92f326d3d57302dbf0c73e1e67

com.whatsapp

(Android.Clipper.31, Tool.LSPatch.2)

7245f6a55eb76963dcb28054b50070e3c75e50b3c03bd2fcbf2eb33eda09ae92

com.whatsapp

(Android.Clipper.30, Tool.LSPatch.1)

03232aaf7864d0d425e7d4e7d8014c415bbca28faf0ba8c072042d49ac32eef4

com.whatsapp

(Android.Spy.5745, Tool.LSPatch.2)

96cf16eab707bfe28400b94da2a48078de47c5ec361422978323f2a6429d7288

com.whatsapp

(Android.Clipper.30, Tool.LSPatch.1)

71bc42fe9d521b35b8a4380ebe1e3d8eafd9f08036a29e4db46334575df43b8d

com.whatsapp

(Android.Siggen.Susp.23047, Tool.LSPatch.1)

60ed890b07b92e00050aea6258a405e8c3a59d3fa93c69c485aacb202a5e0b28

com.whatsapp

(Android.Siggen.Susp.6038, Tool.LSPatch.2)

4b0bf07a8ce1727b77c923111cdceac7129fa9bb29532c7ddd06bddc36da6b35

com.whatsapp

(Android.Spy.5745, Tool.LSPatch.2)

3d1595626c36e0066c9dd368e7e4cc1aa6d5af605fa53f9980bc7346c40c57cb

com.whatsapp

(Android.Clipper.31, Tool.LSPatch.2)

0ac38bf72b21263f5bb3547226342ff405395f32a180ef02d10fa2b158d3e345

com.whatsapp

(Android.Spy.5745, Tool.LSPatch.2)

d29d42297c943f7f618d15781167c6ab42e29293589e7fa86c93180e8f7b52eb

com.whatsapp

(Android.Clipper.Shibai.45, Tool.LSPatch.3)

com.whatsHook

sha256 Package name Detect name

cdd372e0cd9aa820c76bc40a0bc3b352527dd9e155d9e5fbf31837d19e35f679

com.whatsHook

(Android.Clipper.30)

c8657056de30426d8ff8c6de786907a398c78ea4d1d3e830642f54f3ba684c38

com.whatsHook

(Android.Clipper.31)

635360840f6a2d0077d3f7572898fb10957b1db5e0f36cfdde13ff5c474eac81

com.whatsHook

(Android.Clipper.30)

2118694a119b8af7fa64cbdb5edf94e755250d0b02c148e3e4517af59c3fc864

com.whatsHook

(Android.Siggen.Susp.18661)

601798b312869788a6c337f4775e2b40353af56c84df32c0a22833d06fde5f4b

com.whatsHook

(Android.Clipper.31)

8055d16766ae40053c27565acedbb485e7b45658d3418086b7170457cfe8d368

com.whatsHook

(Android.Siggen.Susp.19682)

53b41f28f521945e3f8e1bb13f7221f107f79d61f49a2c4d053a7004199d8677

com.whatsHook

(Android.Clipper.31)

1757ea393566d8ba5d13a89783c249690d7ae8d5eb3be5a2153b974563d51757

com.whatsHook

(Android.Siggen.Susp.10990)

0d69a69e24efdaef3c042dd026e12c511b64a314565ae4187284c5eb4bf29dea

com.whatsHook

(Android.Siggen.Susp.12253)

28d394af4aadebf0866ecc02038ab648af832433bd26b74481a9c1f679f062c8

com.whatsHook

(Android.Siggen.Susp.18202)

6e3549b23e2f6eb895cfe9116446d51f2cad009278294932c0f2857f5c69ca3b

com.whatsHook

(Android.Siggen.Susp.11977)

f56a400dd6a7923251ee6c9a7e95a53c5dae69f255ef0443a8922de253be9848

com.whatsHook

(Android.Clipper.31)

8da17e000061fd31105a8710ace4ce6b1f6334cba9a2fd89ce24151574b1924c

com.whatsapp

(Android.Spy.5745)

767a7e67aa3b734249a0ccac1ef4f78a8ebc4c7d1587fc46e61f5e966140c4ac

com.whatsapp

(Android.Spy.5745)

01b18b757a716519edc1c1e1fd9cddd24c7202c6956b3eae3c8a50718657dc54

com.whatsapp

(Android.Clipper.31)

825b652aea6c74e2492cbb4fcb63e9fe4e2d6bf69c1ae47527c044b9551c5d97

com.whatsHook

(Android.Clipper.30)

f91091978d30640418d024d5d0a0aeac4e30593d2b76d9bc84633fbadb7fbb30

com.whatsapp

(Android.Spy.5745)

acad7947d399517814e67bebbfbd6084406ad9e936a00bfc2ae893d0cf6a2b2e

com.whatsHook

(Android.Clipper.30)

e7ef3b886db7df4b032f4e5009d0cd4416bd26678229919a7e154a41e809bc9d

com.whatsHook

(Android.Siggen.Susp.23047)

f1bbf162f980c04ef034986695cacb2b09343ec29efbc4637b6dd9df111e191f

com.whatsapp

(Android.Siggen.Susp.6038)

f61e64fe65002d26ac57dbe1d7f82c8cbfaf9e8d643453068ce07f071421c357

com.whatsapp

(Android.Spy.5745)

2ca4455e1da346b5d7e562e781e295f887c3d9419015fb14dce1ef4af81de89e

com.whatsapp

(Android.Clipper.31)

6aec43e1df14e214fe1304e36c49b33fe407ba8538cbacca96fdcc92cbdf868b

com.whatsapp

(Android.Spy.5745)

b61b027e36fe96c6bbc59e4f5f18fb54cdb8e8a1cad63ddaa4af7892324349a9

com.whatsHook

(Android.Clipper.Shibai.45)

Other trojanized apps in this campaign

sha256 Package name App name Detect name

0e8dfd5a06e0e5d65a83ff894f8f2ed44614011ffa9434d691391a6e25e4a5a8

com.twitter.android

Twitter

(Android.Clipper.Shibai.5)

1bea59c9f9b87d9eb3aa27698836a19d4731e100706dc6230ce37284679672b8

or.t16074.j

Telegram

(Android.Clipper.Shibai.37)

1dd3415ab07ffd456bd3c96825cc9614903e466e293eb1a17fa6d99f7435dec4

com.twitter.androir

X

(Android.Clipper.Shibai.1)

2c973ac4e224e1110d86175eec9e82844c69c3c598e472de99d08f518c7bf943

com.mathwallet.android

MathWallet

(Android.Clipper.Shibai.31)

3b33bdc8bd16020769f01290788808d5a615da27ea07c9c6d42e0a71eb4d45ee

org.tel41.me

Telegram

(Android.Clipper.Shibai.42)

3ca39fa64ee3d51321ec795019b95d7ab98035c217b2602a96dbcd62026a7e04

com.bintiger.mall.android

拜托拜托

(Android.Clipper.Shibai.14)

4f3a93931bdf44167c22bef42b9ae0045fd57098e6299ca9dff08c8c552812d1

com.jinse.app

金色财经

(Android.Clipper.Shibai.15)

6ac2da3da614ed9d2b833fc3b3bca5ca90741630ca70d739687604a537446937

com.mathwallet.android

MathWallet

(Android.Packed.57100)

6ce354bdf235cfd748886036286f152d7009f4e7a5eb841f36510cf35655640f

org.telegram.messenger

Telegram

(Android.Clipper.Shibai.32)

6d43e6630207474ae6d993309be712f9d70c56f8283d8cc134d2e3dc61f92ece

com.twitter.android

Twitter

(Android.Spy.6030)

7c0f90f6705717d14f89e43fefb87994c2e5da974a2e0176b0bd6400cbb753cc

com.woyue.batchat

蝙蝠

(Android.Clipper.31, Tool.LSPatch.2)

08bb34fcda945a12f981c3e01124e6c4d6a89dca809f5fca256007e1dadec436

org.potato.messenger

Potato

(Android.Packed.57099)

9a8e8b84bdc618fac50ecc33fce4d6efb2b93ff3f50fd584f230a811ec396a6c

com.tradingview.tradingviewapp

TradingView

(Android.Clipper.Shibai.38)

09c162a000a5724e7f5ce14e202b396864dcce2f5287ce1d1f30ca2a0cb53ff7

im.t5011.app

imToken

(Android.CoinSteal.43)

9c6091a8c6379d2189e246feb37e0744decf611aecfcbf9213ec1ea21a4cdf60

com.wemart.mobile

WEMART温超

(Android.Clipper.Shibai.16)

11ae46f6207fa80dc9a49eec5c291395586e506952f38a772bdc22218d7e2a41

com.wukong.waimai

悟空外卖

(Android.Clipper.Shibai.6)

17d0639fb743ba31df966880c521e4ab45e333d45653e4573ac0ecf671b79cf5

lm.t0ken.aqq

imToken

(Android.CoinSteal.43)

41f9e76b18337f2271c82602fe9e9c1d5765e4ab24aa612ea6ad2647b6aa00fe

com.cs_credit_bank

Telegram

(Android.Clipper.Shibai.3)

66e33e2ffbdfa46e5d8dee6ed7a4eecc0ad6b6a553bb4403e12ec8416ea8d0b8

com.coinmarketcap.android

CoinMarketCap

(Android.Clipper.Shibai.27)

77dce07e22af76c32fc0500c6148964fcea9bf1e93b16eafb2edc5521f7c1ddd

com.mathwallet.android

MathWallet

(Android.Clipper.Shibai.17)

85c63275611d2407f9888157c51ec96f8996caac3691e56f74820197f49767c3

com.feixiaohao

Feixiaohao

Android.Siggen.Susp.11526)

86c3e3d9edc90e177d022d9693be779e5398201f47bae53cabdaaa2232d97112

jp.naver.line.androld

LINE

(Android.Clipper.Shibai.7)

097f9be249c9883d7c5ccb22299431d8bc79609b27c3323b03441e6882233f59

com.huobionchainwallet.itokenhd

iToken HD

(Android.Clipper.Shibai.18)

113f3e0a2c7d3c6192de8180383da85e95c4ece8647c430be62608fc6c8c83a6

com.aicoin.appandroid

AICoin

(Android.Clipper.Shibai.24)

543e2a03a906291018c74b8b7cebcfca68e00d391a6b20f21e40580682b47c18

com.wallet.crypto.trustapp

Trust Wallet

(Android.Clipper.Shibai.19)

0660eae66d86849568bd28beda92529738b5dfe64b72494665d9d33609450c39

com.niksoftware.snapseed

Snapseed

(Android.Clipper.Shibai.8)

6280a9da842b6255e6722822aee5de10ba900d77cc59e70e30caf88523dc3f82

org.telegram.messenger

Telegram

(Android.Spy.6717)

6566beebd6c8771147763b65e5bdcebad09c3d813a6932b913d542cf939dbe9c

com.feixiaohao

Feixiaohao

(Android.Siggen.Susp.11526)

32614ba343e59e32e2bba50eccb0432de60634eaa57ebf03ab4e30ea1646ac9f

com.tronlinkpro.wallet

TronLink

(Android.Clipper.Shibai.33)

78625bec3fe0101fd7ec0e3e3f007e2780bdaea4e5683ceff7fd9b96ef45bb2e

jp.nvaer.line.android

LINE

(Android.Clipper.Shibai.9)

320583ca69984b5e30fa85888ce630401455acab2ed19796116f892017c12cdc

com.huione.huionenex

HUIONE

(Android.Clipper.Shibai.20)

2375049af03fa58d9ffa67df2bc41dcb39aeedfa26eca23b3832eb7906ab2f6f

org.j1x9.l

Telegram

(Android.Clipper.Shibai.2)

3783513f15d0e41de2d21fcd941965ff0a650a377448fe5731590a8afea636ee

com.tradingview.tradingviewapp

TradingView

(Android.Clipper.Shibai.40)

5966377d70969ad1af728307a6594de4a570c20c120258ab0f2fde1c0c515fca

org.tele35.enges

Telegram

(Android.Siggen.Susp.21089)

a1b4c4b6c405c06bc7fbb59c08c90cbfb28443020ed74689240e0c8e03315f76

com.onelab.securecomm

Letstalk

(Android.Clipper.Shibai.10)

a2d30148b04fb96f08c5965a3643fbcc62253d6ace3db7d73e1a52ca8345da1b

com.skype.raider

Skype

(Android.Clipper.Shibai.1.origin)

a8da272657006551564494e7fad888191f33470305398fc60a3f8bef015fbbab

org.cloudchat.messengernew.cn

CC

(Android.Clipper.Shibai.21)

a273eb811fca9ca1e837c772433592e2ccdcdd0fea4a1091d37d5005e65ee5f6

org.potato.messenger

Potato

(Android.Clipper.Shibai.11)

a503a8aa5f19fe8fe68b07b25b5ff0547682aa14dcf08ea656bc2f2d28a774ef

com.egets.takeaways

E-GetS

(Android.Clipper.Shibai.22)

ad7e5b760b6fcad4aa91e30b42daa282ccf64fb859e62cb75014d22d1ab9059f

com.feixiaohao

Feixiaohao

(Android.Clipper.Shibai.23)

b0f55e2695e71697353d494d1708d2dd56cfdaa356ce2065896850eb537de588

vip.mytokenpocket

TokenPocket

(Android.Clipper.Shibai.12)

b4bac8fe62066437760552033bc0d335627c84c2eff8a9299fd1f57484e4d09b

org.telegram.messenger

Telegram

(Android.Spy.1226.origin)

b6dab5ce63e27789852c9fe8f05c674e6c557560c86ec78bce052834ca9050c1

org.tel28.me

Telegram

(Android.Clipper.Shibai.43)

b8bf3c4acc403197bafeab9a72a07160b63775bda38619776aac0023bb9ac630

com.tradingview.tradingviewapp

TradingView

(Android.Packed.54935)

b453649085ec632d0678021a9af76804643328c3325ac6ba323f07f9fe70a09e

com.aicoin.appandroid

AICoin

(Android.Clipper.Shibai.25)

bbe215863d48c573f7c9a7ecbf30ae4f4eece2ebe54fcf74a9fee7173568ed23

org.tel16606.messenger.wec

Telegram

(Android.Clipper.33)

c6db9ee882c0901cba75c93403cc420a293867c326e3dedcd20fcd1d998d4060

com.mawnmx.adnjvnayo

CC

(Android.Siggen.Susp.12549)

e1f69f006bf1b71739a9a51a06261bd21d161e5a9ed900d99c3c67e549b57a4f

org.thoughtcrime.securesms

Signal

(Android.Clipper.Shibai.28)

eab6252e6dc6e3579f4c12fe38163a6aa01fca9e71d3f05b9023db26960468a6

org.te16067.me

Telegram

(Android.Clipper.Shibai.36)

ebbb3a16482056fa4dee55be9ac67220a0ae0be035dbde762d832dc84342f479

com.mawnmx.adnjvnayo

CC

(Android.Clipper.Shibai.29)

ebeee8b68937651d782082da6185a892f1a057010b02442729637ffd9235d67f

jp.nvaer.line.android

LINE

(Android.Clipper.Shibai.13)

eddd258b06c3ee1332c1eef7d20f8ec07017a0b531a00950f3824497557b93e7

com.mathwallet.android

MathWallet

(Android.Clipper.Shibai.30)

ef971bda34ba2425523d5a5e98769397b8c01a117c85b79bad8170c14737a509

app.qrcode.go

QR Code Pro

(Android.Clipper.Shibai.6)

f8b2d4b98cfcd52f9e4bd0ef34ecd72a1c5a2284fa42f6f3b7f45098e9a0b405

org.tem.mess215

Telegram

(Android.Clipper.Shibai.41)

f774a3cb331fe885e10a3755c71e2c7a5720cfae18baf41a8779c21fc19ce16d

com.mawnmx.adnjvnayo

CC

(Android.Clipper.Shibai.26)

fc65c331ae8397e4c2c3059aff82477466528fb3049cc1c70ace32c9c3e781c8

com.wallet.crypto.trustapp

Trust Wallet

(Android.Clipper.Shibai.34)

fe52303a550cbac9c080c64d83635c3c6149cc40f03fd6bfb42b8d24353efada

org.te16067m.m

Telegram

(Android.Clipper.Shibai.35)

fee43dfb2fec49f22cf9d59a104b3e51e25c92348a5c9ce5bc4474854ffebff2

com.tradingview.tradingviewapp

TradingView

(Android.Packed.54935)

Network indicators

Distribution domains

apk-download[.]pro
whatsdownloadapp[.]com
whatsappdownload[.[net
ws-app[.]org
mathwallet-app[.]com
mathwallet-apk[.]com
snapseed-apk[.]com
potato-apk[.]com
line-apk[.]org
coinmarketcap-apk[.]com
tokenpocket-app[.]net
ouyi-apk[.]com
tronlink-apk[.]net
trustwallet-apk[.]net
telegramapk[.]pro
ledger-apk[.]com
aicoin-app[.]co
batchat-apk[.]com
feixiaohao-download[.]net
signal-apk[.]com
e-gets-app[.]com
imgokoo-apk[.]com
btok-app[.]org
itoken-apk[.]com
wemart-apk[.]com
huione[.]im
icomecome-apk[.]com
cloudchat-dl[.]com
caoliao[.]co
letstalkapk[.]com
tradingview[.]im
imtoken-apk[.]co
jinsecaijing[.]vip
tradingview-app[.]im

C2 servers

whatappic[.]com
whatapwr[.]com
tokentrad[.]net
dd1aw3xx[.]com
xiatian2021[.]com
chun2021[.]com
cc1232211[.]com
yyzspeed[.]com
bn-download4[.]com
cmcjk13[.]com
feizhouht[.]com
10hao11-15[.]com
bfadd1[.]com
bfpic1[.]com
20hout[.]com
exquickvpn[.]com
fbpic001[.]com
ltkddsqwx[.]com
14hjiekou[.]com
fbadd001[.]com
imapi04[.]com
9pic001[.]com
mxvzlcbf[.]com
qchbcy4t[.]com
wjkpi18[.]com
14haofeijiht[.]com
14walletapi[.]com
chaojiqianht[.]com
ethereumdf[.]com
wsadd001[.]com
wspic001[.]com
14haofeijijk[.]com
canadaht[.]com
t7xkyjzh[.]com
rombna74[.]com
kwcmceyy[.]com
2ezj9i7k[.]com
wtnt7lpc[.]com
wrnwp2ke[.]com
nxhc7nqh[.]com
v0jxxzyo[.]com
tuite13041[.]com
wjkwr18[.]com
1h9add[.]com
1h9pic[.]com
baituo16a[.]com
jinse16a[.]com
tppic01[.]com
2h5add[.]com
2h5pic[.]com
wenchao16a[.]com
expassvpn[.]com
hw16001[.]com
aa1232211[.]com
10dddssjk[.]com
sinadd1[.]com
sinpic1[.]com
ffghj10[.]com
fj1h9qdpic[.]com
tgup1988[.]com
tgadd0002[.]com
tgpic0001[.]com
fj1h9qd[.]com
v8beXTM[.]com
81w75Ym[.]com

Crypto wallets

BTC	34Uwdtgks5ZPd7jGR1sgKxXffHsXxU3L7i
BTC	33MxfabeF34Z4QSMFvdFnTQ3jq8pshAiaN
BTC	32KzKciQ3hYSdL9qWYN5XCRpBYPcSDg5v2
BTC	3Q4Bzp5jqsUrZNisdQLgCfGdNCMgiAd17W
BTC	1LnstwrXQziMkD73pbgPJGVffVDjVmFFeQ
TRX	TN7pfenJ1ePpjoPFaeu46pxjT9rhYDqW66
TRX	TTJouPfzRzvZaKrHmEdhKrFwK9wmUcRbaq
TRX	TH8os5fG3EnCwmUdA7ES87T5Q29e7egfet
TRX	TX9REbP7c5rQqioTv4xnkjNRfCa65u12MB
TRX	TUN8obB5HrtZwW1BDbzzwVRtptXchRyCWb
TRX	TPRpD86bbhh9K2L7bAbBJnnGws5qzoLhXc
TRX	TAhCuWTkugNLGwL4Gxvu6qLsfjgHS4iaMQ
TRX	TEGtKLavujdMrYxQWAsowXqxUHMdurUhRP
TRX	TAEMkNxGbwqHE5662TSPtzqhvJKy9EWSCQ
TRX	TFFP2HKP2t3BekDmuvpYkotxQzXgb6N5Pu
TRX	TLKqQutY6DTpLMCM2aeNgc947JytiTz8NF
TRX	TBDYiUrfyjZPMhjW3yMLFeUNFTSaJMTDEr
ETH	0x3112f8d158F9B588D737b5071f305f109d31596B
ETH	0x673dB7Ed16A13Aa137d39401a085892D5e1f0fCA
ETH	0x83e722447856aC0e3CD95377a53fD810226b82c2
ETH	0xBb26bc117EDaa1e0Dd3ECbd2EE82854E9251bB90
ETH	0x43d29435506374e848693D057DCF4db519A6EC6b
ETH	0xFE21DE665613D29E05B9bca13FaEc088735e9011
ETH	0x071665fe18A5A9b23D10d849c9dB1fB1b079fB57
ETH	0x03d65A25Db71C228c4BD202C4d6DbF06f772323A
ETH	0x73fC576Ec57f529aaFfbAeE4cB880AdcF2C75f11
ETH	0x4e2A2e3067E6764724270Eb9a13F4e5D23Dde365
ETH	0x1EAdBAB63d2767A554eBC99bD3F868CEbE274413
ETH	0xAd65bF39d0433598714b3Af5EfFBABc8a202f8eD