Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    146s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    19/12/2024, 22:00

General

  • Target

    385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk

  • Size

    1.7MB

  • MD5

    c1808b481e4f1ef71045d0a7e2619f65

  • SHA1

    d86c9881ac6e5d58f99be555cb52cf88b2ae4fee

  • SHA256

    385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3

  • SHA512

    62a89f9da0749852a740c62cac3ba03430a40588979dbc80ff832144a0c6cfce55eb5de0d655f7bc6a021b78b1796e0b4f62a715af91d06caf134d02bb6e47b7

  • SSDEEP

    49152:pA+KidEeQ/WIWowWWahJnMA1uFDnoNTLbcemZWhLrL:pFdG/1WowWoA1KsNTLgemM1

Malware Config

Extracted

Family

cerberus

C2

http://94.250.253.26

Signatures

Processes

  • com.swing.often
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Tries to add a device administrator.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4465

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.swing.often/app_DynamicOptDex/NQ.json

    Filesize

    35KB

    MD5

    ec322e38c43afd6e408508b97f43aef2

    SHA1

    adadb7ad49531cbfd3f3531cfec875f81905b89b

    SHA256

    267027e868b821518ba2ffc000d424ce76e9e28b0b81e40da3d697328c02622d

    SHA512

    e6a5b8dc8ae9de235c0e3b3cca6af059d9c1bc1056e15510658c5679aa49f5e133e46a92bf042f2284eaceea6d800bef49d5bab505adc8b03f1e1ae6de5f570b

  • /data/user/0/com.swing.often/app_DynamicOptDex/NQ.json

    Filesize

    35KB

    MD5

    91e08fbc47e803f3f5bd2e0d39e8f167

    SHA1

    cfea44c91ea7ad6d866aa21e7412cfbd00873fa0

    SHA256

    8381d8eed74280e8cd5a6e6808963c17228729bc1d04353898d05e9815555d40

    SHA512

    b23155758dbc7df8ab5b0d1bab2439672f20da15129419bd2cd432b89d9b527b0cc03fdca6c1e04d3ac9495df4fffe7c9b8586bef311a98cbad08d1369710122

  • /data/user/0/com.swing.often/app_DynamicOptDex/NQ.json

    Filesize

    77KB

    MD5

    fbfec32963eec74794d898179aee8b56

    SHA1

    cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6

    SHA256

    d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9

    SHA512

    f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe

  • /data/user/0/com.swing.often/app_DynamicOptDex/oat/NQ.json.cur.prof

    Filesize

    148B

    MD5

    500d3f1e197921b0435bc18ca45433a2

    SHA1

    71f0575f6f6b88864a69de401fbfe4350a01493c

    SHA256

    cce67a5a6b277356e9a215774d066fdee32a61ad12636ae5b51f19b929dde448

    SHA512

    e2847e235da2f3911865368b7b09d3b34d62d8c7ce1e6a2c1fc062d53c30a51c90b6d6e9ed3ea0680694b06d2384798acf2972c5d7c68583c62f8da90c10f6bf