Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
146s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
19/12/2024, 22:00
General
-
Target
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk
-
Size
1.7MB
-
MD5
c1808b481e4f1ef71045d0a7e2619f65
-
SHA1
d86c9881ac6e5d58f99be555cb52cf88b2ae4fee
-
SHA256
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3
-
SHA512
62a89f9da0749852a740c62cac3ba03430a40588979dbc80ff832144a0c6cfce55eb5de0d655f7bc6a021b78b1796e0b4f62a715af91d06caf134d02bb6e47b7
-
SSDEEP
49152:pA+KidEeQ/WIWowWWahJnMA1uFDnoNTLbcemZWhLrL:pFdG/1WowWoA1KsNTLgemM1
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.swing.often1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5ec322e38c43afd6e408508b97f43aef2
SHA1adadb7ad49531cbfd3f3531cfec875f81905b89b
SHA256267027e868b821518ba2ffc000d424ce76e9e28b0b81e40da3d697328c02622d
SHA512e6a5b8dc8ae9de235c0e3b3cca6af059d9c1bc1056e15510658c5679aa49f5e133e46a92bf042f2284eaceea6d800bef49d5bab505adc8b03f1e1ae6de5f570b
-
Filesize
35KB
MD591e08fbc47e803f3f5bd2e0d39e8f167
SHA1cfea44c91ea7ad6d866aa21e7412cfbd00873fa0
SHA2568381d8eed74280e8cd5a6e6808963c17228729bc1d04353898d05e9815555d40
SHA512b23155758dbc7df8ab5b0d1bab2439672f20da15129419bd2cd432b89d9b527b0cc03fdca6c1e04d3ac9495df4fffe7c9b8586bef311a98cbad08d1369710122
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe
-
Filesize
148B
MD5500d3f1e197921b0435bc18ca45433a2
SHA171f0575f6f6b88864a69de401fbfe4350a01493c
SHA256cce67a5a6b277356e9a215774d066fdee32a61ad12636ae5b51f19b929dde448
SHA512e2847e235da2f3911865368b7b09d3b34d62d8c7ce1e6a2c1fc062d53c30a51c90b6d6e9ed3ea0680694b06d2384798acf2972c5d7c68583c62f8da90c10f6bf