Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
756f114a308...1b.apk
android-9-x86
1056f114a308...1b.apk
android-10-x64
1056f114a308...1b.apk
android-11-x64
10bootstrap.min.js
windows7-x64
1bootstrap.min.js
windows10-2004-x64
1epl1.html
windows7-x64
1epl1.html
windows10-2004-x64
1gpl_3.html
windows7-x64
1gpl_3.html
windows10-2004-x64
1howto.html
windows7-x64
1howto.html
windows10-2004-x64
1jquery-2.1.1.min.js
windows7-x64
1jquery-2.1.1.min.js
windows10-2004-x64
1keyboard.js
windows7-x64
1keyboard.js
windows10-2004-x64
1libcore.so
ubuntu-18.04-amd64
libcore.so
debian-9-armhf
libcore.so
debian-9-mips
libcore.so
debian-9-mipsel
libnative.so
ubuntu-18.04-amd64
libnative.so
debian-9-armhf
libnative.so
debian-9-mips
libnative.so
debian-9-mipsel
mit.html
windows7-x64
1mit.html
windows10-2004-x64
1mpl2.html
windows7-x64
1mpl2.html
windows10-2004-x64
1mraid.js
windows7-x64
1mraid.js
windows10-2004-x64
1mraid3.js
windows7-x64
1mraid3.js
windows10-2004-x64
1omsdk-v1.js
windows7-x64
1Analysis
-
max time kernel
2796444s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20231023-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20231023-enlocale:en-usos:android-9-x86system -
submitted
06/11/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
56f114a308194e9804635afa69c8edae27d2a64f0cfd6991fc62eec12e9b941b.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
56f114a308194e9804635afa69c8edae27d2a64f0cfd6991fc62eec12e9b941b.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
56f114a308194e9804635afa69c8edae27d2a64f0cfd6991fc62eec12e9b941b.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
bootstrap.min.js
Resource
win7-20231020-en
Behavioral task
behavioral5
Sample
bootstrap.min.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral6
Sample
epl1.html
Resource
win7-20231023-en
Behavioral task
behavioral7
Sample
epl1.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
gpl_3.html
Resource
win7-20231020-en
Behavioral task
behavioral9
Sample
gpl_3.html
Resource
win10v2004-20231025-en
Behavioral task
behavioral10
Sample
howto.html
Resource
win7-20231020-en
Behavioral task
behavioral11
Sample
howto.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
jquery-2.1.1.min.js
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
jquery-2.1.1.min.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
keyboard.js
Resource
win7-20231023-en
Behavioral task
behavioral15
Sample
keyboard.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
libcore.so
Resource
ubuntu1804-amd64-20231026-en
Behavioral task
behavioral17
Sample
libcore.so
Resource
debian9-armhf-20231026-en
Behavioral task
behavioral18
Sample
libcore.so
Resource
debian9-mipsbe-20231026-en
Behavioral task
behavioral19
Sample
libcore.so
Resource
debian9-mipsel-20231026-en
Behavioral task
behavioral20
Sample
libnative.so
Resource
ubuntu1804-amd64-20231026-en
Behavioral task
behavioral21
Sample
libnative.so
Resource
debian9-armhf-20231026-en
Behavioral task
behavioral22
Sample
libnative.so
Resource
debian9-mipsbe-20231026-en
Behavioral task
behavioral23
Sample
libnative.so
Resource
debian9-mipsel-20231026-en
Behavioral task
behavioral24
Sample
mit.html
Resource
win7-20231020-en
Behavioral task
behavioral25
Sample
mit.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral26
Sample
mpl2.html
Resource
win7-20231025-en
Behavioral task
behavioral27
Sample
mpl2.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral28
Sample
mraid.js
Resource
win7-20231020-en
Behavioral task
behavioral29
Sample
mraid.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral30
Sample
mraid3.js
Resource
win7-20231025-en
Behavioral task
behavioral31
Sample
mraid3.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral32
Sample
omsdk-v1.js
Resource
win7-20231020-en
General
-
Target
56f114a308194e9804635afa69c8edae27d2a64f0cfd6991fc62eec12e9b941b.apk
-
Size
1.8MB
-
MD5
59daaa414b30e52072b056b78300e3e7
-
SHA1
0a4e9326ebb657db5de4716ed96b264edeb7b441
-
SHA256
56f114a308194e9804635afa69c8edae27d2a64f0cfd6991fc62eec12e9b941b
-
SHA512
ce3e7b9ea1f7236b4830d03c7a46367331da969e15613e4b261c225d4fa2ece3ce5ec58b2dbb787580ccb9f9d0d5c318ae8c3d60b1c9873d52f8a30e097edda2
-
SSDEEP
49152:GKDkRK5ciwVZYt+JJ2f4N3jnx6wPm4i9eV3GZWa0U1:JkRK9wDYtl4N3jx6wPmv9Gs1
Malware Config
Extracted
cerberus
http://142.44.163.144
Signatures
-
Makes use of the framework's Accessibility service. 2 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.hybrid.harsh Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.hybrid.harsh -
pid Process 4253 com.hybrid.harsh -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.hybrid.harsh/app_DynamicOptDex/WGEckrw.json 4279 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hybrid.harsh/app_DynamicOptDex/WGEckrw.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.hybrid.harsh/app_DynamicOptDex/oat/x86/WGEckrw.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.hybrid.harsh/app_DynamicOptDex/WGEckrw.json 4253 com.hybrid.harsh -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.hybrid.harsh -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.hybrid.harsh -
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.hybrid.harsh
Processes
-
com.hybrid.harsh1⤵
- Makes use of the framework's Accessibility service.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:4253 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hybrid.harsh/app_DynamicOptDex/WGEckrw.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.hybrid.harsh/app_DynamicOptDex/oat/x86/WGEckrw.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4279
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD53a8bb927114a7b078c61523f4bfb37e3
SHA1d0393cbf5385ffed537621ac2e47aaa9648c29d2
SHA2561989518a068269b7641ef11aa0595cc357fc0179c912a8283b2f71743ea44e51
SHA5121f026ec9dbac025e87f38d2c35667c3ec70923857dc3d541b035181d789061a8231ab411a332c906629dbb997b8eaf576148edd13c17ec344f92ba40aa9dfca0
-
Filesize
64KB
MD5644256e0c745741f6a3dcce4b5bbf771
SHA1d1538c7fcd420e3b0429ec663f9a5d1cfc82f0da
SHA2564e981fa0622b5f98df5f102c5fc2881684d760d4b0cb4b64bf1eb8cabb1aa9ff
SHA5122f975b7d789d3e3dc0ff3585670f043e605c971260c1c35d04237db97f9a8b0d4d7b5195c73b3bef4a215abd6cc9a6dc923003045e17ab8698c43aecf7369525
-
Filesize
830B
MD5d839e21a07d204e59afe6098d23564be
SHA1490a17702ccbfea52cec789f8b112b6905300d89
SHA256410047011360db37f5dc9a9cfff3322c8fac8cbeead1b4f0bd3ed384b3bca064
SHA512d17366547ec357d54784bf12cd34f5c6ce6e8daed589c6276f78e8064037f9a86084ab0dcec00f2933b0efa068680b82dff6df784dd50a33a773fe68f11ed916
-
Filesize
125KB
MD536147550f98cbe8f3229579ca6b41fa1
SHA1b263c678e1609f3a6c328fcd64305f56212fcfe2
SHA2563e75bf1959f48b764c503daab0f10e74f8cddf6dda93c6e3be8e29cce4fec6d8
SHA51212d61fafe23d7ad4d3efbf110150e0fc5c75ef58e1fdcada4570dbe34351a90ab3ecb66aaca49a98b113851971e5cfc1d623a67cab028e3a42ba139d9c002c00
-
Filesize
125KB
MD51838419e697f62ae8c52800822e89659
SHA1589496e597ae80ba99d89f52396eb080c4324794
SHA25674c6fb2aa041c87ea9ccb6d4b6a36983e279875722e068461a66c42e09b192ef
SHA512f14ee2843e28e7ccd1832f35503e026e9354713038479359ddd2bc6c65ffe6d9653f41dd8014d936b45c6227db646a08968152452cf7728ced9fc52318a58d31