Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    133s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    17/08/2024, 22:06

General

  • Target

    e64d88f2983643b9179f2395665e520ee2f0b54d98f3cc9890af24247a0dfaf7.apk

  • Size

    1.5MB

  • MD5

    c7daeb9363683cc6abf12e525e66fe62

  • SHA1

    0ed296f84c33e6af6640de2edd92096e442c4a7c

  • SHA256

    e64d88f2983643b9179f2395665e520ee2f0b54d98f3cc9890af24247a0dfaf7

  • SHA512

    bb4328ba8591dad88862fb71fd0814012fa4a0edf5664b3fe379c43db318454ae63e1ccf1f91e03d29524592faa1bd3dbe08cddfa83332377df0928cc09ede22

  • SSDEEP

    24576:3M1MQnSioliBDj1id5+V4acoB8/KZtAejee/FjVpV3i3+nLGmKemNsWhWmBh:caojBID44aF8/kTjeuFjZi+nLGhemOWt

Malware Config

Extracted

Family

cerberus

C2

http://sappzaebiservak.ru

Signatures

Processes

  • com.dice.absorb
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4649

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.dice.absorb/app_DynamicOptDex/cpoJjuI.json

    Filesize

    64KB

    MD5

    017884ef15aa91cfdf37c94147f1b163

    SHA1

    1afc14310f8951b47599de4d7451a06c8c9523d6

    SHA256

    94f176cec47a81170e7ef916fa91dfca93ef1a6f5f28c6398a1bba346f9baebc

    SHA512

    277317b49a467272f69692285967cfc38e269cada002757276b0e8b1dc09b0cc34b9306308578694990a532734affcd773ef9f602b1361bd7604493b1d7f4f2f

  • /data/user/0/com.dice.absorb/app_DynamicOptDex/cpoJjuI.json

    Filesize

    64KB

    MD5

    c2232f9ca84ff1b0d4586122b39dc9e4

    SHA1

    ac206db3e20435fff95329cf01b2d8d9ca741ec1

    SHA256

    8a5bd3eb6fc0dcbfee808daf752923af0951a23c62f4f002d01ec957602d8943

    SHA512

    b4167eb4407ce7bf74862e78d98402ba72e7d3fbe291300e5865fcca75f1d3cf5c833405002f358172fb557c35edafbb39445ca51bd0e9bdb7f3086d9bb2f8da

  • /data/user/0/com.dice.absorb/app_DynamicOptDex/cpoJjuI.json

    Filesize

    118KB

    MD5

    08f818e7b9a7b3d91d0c64db2adfe623

    SHA1

    1e17fc5a6bd7d29307dd04df8bbc4edeb9680e1e

    SHA256

    252acf5a3ea28210b475900263cc192c3422984522b5e7e50e7ac18bd2e579e9

    SHA512

    6177922b522f05f44ad45c82d9719bf718e9bf44fcd8354f01339feb0ccf657d5ffcc4060cd37544f116ad55e28c3a64b31f31ab5b2613a935229d595fbcfa36

  • /data/user/0/com.dice.absorb/app_DynamicOptDex/oat/cpoJjuI.json.cur.prof

    Filesize

    151B

    MD5

    aee9f5c6a614fb77f4ff0cf71008a714

    SHA1

    0d1beecb5eae7a92511be28947cf481bb0c1a120

    SHA256

    d1178f06312d7b2d4c8eab671789e013398be5960c7d2fca9e293bacf8f6d760

    SHA512

    01c5f1c4077b6a1d794cb0ea30d109831ad6ce17eb420c20ea340d21b13873eb3539d0bd2aa4a8f0104ea93ec18ca2544b2e70c05edca4e1a56999f475814fc7