Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2487922s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
20/12/2023, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0.apk
Behavioral task
behavioral2
Sample
9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0.apk
Resource
android-x64-20231215-en
General
-
Target
9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0.apk
-
Size
1.8MB
-
MD5
725898490828771711e487a67aeb149b
-
SHA1
b146d8812c79e1cd7b46127efe26aaaaa668b4f2
-
SHA256
9ffda0c1e8e9e9c63c5219941f3f72f04ef8027b2ed8443498100df27e00b8b0
-
SHA512
24884a2d340e7ef032c7d0e117624c731dc97e7f1a966d9e059740e962970c8681446f857acc963668ba7d4a46b5e5baec33050a5276778cd0c5b416167bed3b
-
SSDEEP
49152:mpGJxMZEDaeHWqYaVQdk4Vc5RTSijsztY:wGJe+OeHWqYGQdkThSiAJY
Malware Config
Extracted
cerberus
http://teknoasaglik.online
Signatures
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu -
pid Process 4999 njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json 4999 njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu /data/user/0/njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu/app_DynamicOptDex/CLgH.json 4999 njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu -
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener njrubljhdew.zkqncfm.cdjqppywpayaaciuwswzu
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
791KB
MD5d3dffc453a8761be6d45825a501ad430
SHA175d1529a3425c7e49aa67d90f751e3a78b66e359
SHA25660ef60157445a623636d55e81347a2f0fc322a1c8d98a0421f269330e6401734
SHA51204c5031249a9db1074f413de9b910236af5d86b5893a7388627e8e72baf05b20ab029c4c215b4aa5e4c4133c64f24527f2d6e246e6fbe11c7c4d1de6956f11e6
-
Filesize
791KB
MD5b6dc5b2f98e5c26b494e6b5d21900dc7
SHA11aeeab5f0e028e536e9f34a9711c27e8c26cbdba
SHA256058b5927de385c9daa9ef67731dd912e9ae4265b43ca676872e18db9aed3f228
SHA5128b9928b5ad1a44f8bebe593f0fd12bf46a457a0a2d20afd2b73013528df1f901ca07190a71ab4739afaf63db6c9c39c9f10c277609385c5395c4dfdeebcf351c
-
Filesize
241B
MD57d45162f0a7d41234921eafe9239f3d7
SHA17b4eee45434891a18feb3472708df328c52c8b67
SHA25663e7c24b47e0e5dfed18735d35558dbd3a52ed7d7b233b64c96d60fa74f08c66
SHA51228b697917f55e434ce510fe53e55fa7d0d2dc8b4075d0551a9230d199ed87bddb00656ed75373626578dd03dfe774b3d2a9c77f04d439d709ed4ad9c8fbac2e7