Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    724326854d7a9a690804dddd1b2a8238

  • Size

    3.2MB

  • Sample

    240124-pt8draaddn

  • MD5

    724326854d7a9a690804dddd1b2a8238

  • SHA1

    77648e958dae35902a2da8e78abf1f63df6fbaff

  • SHA256

    ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa

  • SHA512

    bcdede85ed64d46007907e03fefda9170bdbbdd05ebcc83a42fc7aed54aa3fcf529dcd348e3bf9ed044e805a1e5e6861d589b7a10c86440c66d0254230fc7f71

  • SSDEEP

    49152:FjswnszFXACO2rlrANH99yeSmjpHe/4zXLc8CycUsrYPPbk5/Ehi7vXBYc:4ZACOIW9EeUIbc8WUa4kGyp

Malware Config

Extracted

Family

cerberus

C2

http://147.182.194.197

Targets

    • Target

      724326854d7a9a690804dddd1b2a8238

    • Size

      3.2MB

    • MD5

      724326854d7a9a690804dddd1b2a8238

    • SHA1

      77648e958dae35902a2da8e78abf1f63df6fbaff

    • SHA256

      ea467ca29a1c33e37ae7beac8fe68f2866cb9dcaacb579ec3b53fff70e17b1fa

    • SHA512

      bcdede85ed64d46007907e03fefda9170bdbbdd05ebcc83a42fc7aed54aa3fcf529dcd348e3bf9ed044e805a1e5e6861d589b7a10c86440c66d0254230fc7f71

    • SSDEEP

      49152:FjswnszFXACO2rlrANH99yeSmjpHe/4zXLc8CycUsrYPPbk5/Ehi7vXBYc:4ZACOIW9EeUIbc8WUa4kGyp

    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Tries to add a device administrator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Matrix

Tasks