Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3247416s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    30/12/2023, 12:16

General

  • Target

    183ac21bb70d1e9527de39136d927094.apk

  • Size

    4.0MB

  • MD5

    183ac21bb70d1e9527de39136d927094

  • SHA1

    c654873f2c978fd1538e215a8db6ca847a06fbb0

  • SHA256

    cf3e16d6328d572cdf4476809e25c52790d77bec8ac1a52a7129485c55a7c6a7

  • SHA512

    cc6c3cb1f86d05c5072b3d5bc57af690f2b49ca054e505bc67ce758586076c0d8fecff50e8e7b1c06295fc8637134f6ace6a14570fbbba74d3bbf29da80a6cf4

  • SSDEEP

    98304:kFWGTMw78bjU4Tg3rwk/K1xGbuGV9Nt4DWzpnw+YHq7+ri1:kFWGTMg8bjfsXaxGi09L4DK+LHba

Malware Config

Extracted

Family

cerberus

C2

http://193.37.212.83/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Removes its main activity from the application launcher 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

Processes

  • stay.benefit.recall
    1⤵
    • Makes use of the framework's Accessibility service
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4993

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/stay.benefit.recall/app_DynamicOptDex/Gg.json

    Filesize

    632KB

    MD5

    6bfef990369fee2cc5ec8605b5d0ce51

    SHA1

    aeddc9116de32f60156860eac0e2301d41275c53

    SHA256

    3c242dca190479fecf6f73e083d70097b6b835f26ba1613414ab7ea6480557c8

    SHA512

    8dd86385b5395dc6d6f0460cf9863fd3aab2942e1d31342b1d330e96886baf2a5a207dc5ab2d60747b10e68d124d8f3885ee74dd1186477997fffc53c80c349d

  • /data/data/stay.benefit.recall/app_DynamicOptDex/Gg.json

    Filesize

    632KB

    MD5

    78264d3e20ce5c48c395d05d5fe38ec5

    SHA1

    da11537c8f15de9150fa902767fac39f6952e58f

    SHA256

    b863a1f8fdbdee8eba238fd32820a942b6228cb4e71c33ce58208b6c3b0ae3f1

    SHA512

    928c931733d9b88391beb530f62779a4795bdcc45e6597d6833a480a971643b0fe22828d3b6c6fcdf30ce4eb03ea276d9f2d9faff103a9e7d0f819d124b8135d

  • /data/data/stay.benefit.recall/app_DynamicOptDex/oat/Gg.json.cur.prof

    Filesize

    255B

    MD5

    e7a008b0b54e581c297292cf97697873

    SHA1

    ba76f85eefa53779d0201c5634686a5b312ab597

    SHA256

    702a6f8333aeb7c61d89fc2f2d71ff0e871899468da86f693090f41f21c9ee20

    SHA512

    8aa385198c104e03b1892481979ac9d4a465289aacaec355a66d7aec2b8b96fef99cbec4b2e10e36c29c44711a294e6e032b16015e37fbf07b6fafa9128c00ab