Overview
overview
8Static
static
6ROOT/APK/G...ak.apk
ROOT/APK/G...ak.apk
android-10-x64
ROOT/APK/G...ak.apk
android-11-x64
superuser.apk
superuser.apk
android-10-x64
8superuser.apk
android-11-x64
8ROOT/APK/S...er.apk
ROOT/APK/S...er.apk
android-10-x64
ROOT/APK/S...er.apk
android-11-x64
ROOT/APK/su
debian-9-armhf
ROOT/APK/�...��.apk
ROOT/APK/�...��.apk
android-10-x64
ROOT/APK/�...��.apk
android-11-x64
ROOT/AdbWinApi.dll
windows7-x64
3ROOT/AdbWinApi.dll
windows10-2004-x64
3ROOT/AdbWinUsbApi.dll
windows7-x64
1ROOT/AdbWinUsbApi.dll
windows10-2004-x64
3ROOT/Root.bat
windows7-x64
1ROOT/Root.bat
windows10-2004-x64
1ROOT/adb.exe
windows7-x64
1ROOT/adb.exe
windows10-2004-x64
1ROOT/zergRush
debian-9-armhf
删除文�...��.xls
windows7-x64
1删除文�...��.xls
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 16:11
Static task
static1
Behavioral task
behavioral1
Sample
ROOT/APK/GingerBreak.apk
Behavioral task
behavioral2
Sample
ROOT/APK/GingerBreak.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral3
Sample
ROOT/APK/GingerBreak.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral4
Sample
superuser.apk
Behavioral task
behavioral5
Sample
superuser.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral6
Sample
superuser.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral7
Sample
ROOT/APK/Superuser.apk
Behavioral task
behavioral8
Sample
ROOT/APK/Superuser.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral9
Sample
ROOT/APK/Superuser.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral10
Sample
ROOT/APK/su
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral11
Sample
ROOT/APK/系统程序卸载器V3.0汉化版.apk
Behavioral task
behavioral12
Sample
ROOT/APK/系统程序卸载器V3.0汉化版.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral13
Sample
ROOT/APK/系统程序卸载器V3.0汉化版.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral14
Sample
ROOT/AdbWinApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral15
Sample
ROOT/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
ROOT/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral17
Sample
ROOT/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral18
Sample
ROOT/Root.bat
Resource
win7-20231215-en
Behavioral task
behavioral19
Sample
ROOT/Root.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
ROOT/adb.exe
Resource
win7-20231215-en
Behavioral task
behavioral21
Sample
ROOT/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral22
Sample
ROOT/zergRush
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral23
Sample
删除文件对照表.xls
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
删除文件对照表.xls
Resource
win10v2004-20231215-en
General
-
Target
ROOT/AdbWinApi.dll
-
Size
94KB
-
MD5
47a6ee3f186b2c2f5057028906bac0c6
-
SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8
-
SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b
-
SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584
-
SSDEEP
1536:npCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:npo0k6ZWVTaif6sCG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4352 872 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5028 wrote to memory of 872 5028 rundll32.exe 14 PID 5028 wrote to memory of 872 5028 rundll32.exe 14 PID 5028 wrote to memory of 872 5028 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ROOT\AdbWinApi.dll,#11⤵PID:872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 6202⤵
- Program crash
PID:4352
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ROOT\AdbWinApi.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 872 -ip 8721⤵PID:3240