Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
146s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
19/12/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3.apk
-
Size
1.7MB
-
MD5
c1808b481e4f1ef71045d0a7e2619f65
-
SHA1
d86c9881ac6e5d58f99be555cb52cf88b2ae4fee
-
SHA256
385c92b0c4f5af85151eaed41bf8d11bf726921e7a4a36fbfc2c9aad45addba3
-
SHA512
62a89f9da0749852a740c62cac3ba03430a40588979dbc80ff832144a0c6cfce55eb5de0d655f7bc6a021b78b1796e0b4f62a715af91d06caf134d02bb6e47b7
-
SSDEEP
49152:pA+KidEeQ/WIWowWWahJnMA1uFDnoNTLbcemZWhLrL:pFdG/1WowWoA1KsNTLgemM1
Malware Config
Extracted
cerberus
http://94.250.253.26
Signatures
-
Cerberus family
-
pid Process 4465 com.swing.often 4465 com.swing.often -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.swing.often/app_DynamicOptDex/NQ.json 4465 com.swing.often [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.swing.often/app_DynamicOptDex/NQ.json] 4465 com.swing.often [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.swing.often/app_DynamicOptDex/NQ.json] 4465 com.swing.often -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.swing.often Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.swing.often Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.swing.often -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.swing.often -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.swing.often android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.swing.often android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.swing.often android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.swing.often -
Requests changing the default SMS application. 2 TTPs 1 IoCs
description ioc Process Intent action android.provider.Telephony.ACTION_CHANGE_DEFAULT com.swing.often -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.swing.often -
Tries to add a device administrator. 2 TTPs 1 IoCs
description ioc Process Intent action android.app.action.ADD_DEVICE_ADMIN com.swing.often -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.swing.often -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.swing.often -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.swing.often
Processes
-
com.swing.often1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4465
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5ec322e38c43afd6e408508b97f43aef2
SHA1adadb7ad49531cbfd3f3531cfec875f81905b89b
SHA256267027e868b821518ba2ffc000d424ce76e9e28b0b81e40da3d697328c02622d
SHA512e6a5b8dc8ae9de235c0e3b3cca6af059d9c1bc1056e15510658c5679aa49f5e133e46a92bf042f2284eaceea6d800bef49d5bab505adc8b03f1e1ae6de5f570b
-
Filesize
35KB
MD591e08fbc47e803f3f5bd2e0d39e8f167
SHA1cfea44c91ea7ad6d866aa21e7412cfbd00873fa0
SHA2568381d8eed74280e8cd5a6e6808963c17228729bc1d04353898d05e9815555d40
SHA512b23155758dbc7df8ab5b0d1bab2439672f20da15129419bd2cd432b89d9b527b0cc03fdca6c1e04d3ac9495df4fffe7c9b8586bef311a98cbad08d1369710122
-
Filesize
77KB
MD5fbfec32963eec74794d898179aee8b56
SHA1cc98bdf6e6fc12d7fb8ec6caf36d7b0cb35f7ca6
SHA256d15f4935437ed4422d98c2c68a1d352a781300349596adba217d9b2b94e2eca9
SHA512f846a87654034a0e00044859e354598e244d4d52c0af1bc9240b143c566919c0aa108baaeb9bf24e8c030f973b1202c417e82d72db7b0b045ba2371fdc5c1bfe
-
Filesize
148B
MD5500d3f1e197921b0435bc18ca45433a2
SHA171f0575f6f6b88864a69de401fbfe4350a01493c
SHA256cce67a5a6b277356e9a215774d066fdee32a61ad12636ae5b51f19b929dde448
SHA512e2847e235da2f3911865368b7b09d3b34d62d8c7ce1e6a2c1fc062d53c30a51c90b6d6e9ed3ea0680694b06d2384798acf2972c5d7c68583c62f8da90c10f6bf