Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3528183s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system -
submitted
31/12/2023, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
311a7c63e1bc046c93389619e4d575fd.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
311a7c63e1bc046c93389619e4d575fd.apk
Resource
android-x64-20231215-en
General
-
Target
311a7c63e1bc046c93389619e4d575fd.apk
-
Size
149KB
-
MD5
311a7c63e1bc046c93389619e4d575fd
-
SHA1
01b97d16bf0a1d22ef906b364ce374dd474d6d18
-
SHA256
13436a08047a69ec2e258eb718512d74f101e01638b17ab6fc7b53a92f0047e8
-
SHA512
6b9a95b7028606b82546ac2dc8587b046db250973a115f805281948769ace181e88b11feddec7b85d4d2cc476b4fbc8efdac5726c3e7c7ee2378db12b6f17c84
-
SSDEEP
3072:iqMiy35aRvgtguvf4ZlYYBTcmQD/0UxKPnVBIVBQhPZhPRh4t:iqMH3Xgu34UYB1Qj0Uxi/I/SHJh4t
Malware Config
Extracted
cerberus
https://genclikbayramlari.com
Signatures
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.mtcifx.epxpzddgchs Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.mtcifx.epxpzddgchs -
pid Process 4647 com.mtcifx.epxpzddgchs -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.mtcifx.epxpzddgchs -
Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.mtcifx.epxpzddgchs
Processes
-
com.mtcifx.epxpzddgchs1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4647