Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

105826ea06...b0.apk

android-9-x86

10

105826ea06...b0.apk

android-10-x64

10

105826ea06...b0.apk

android-11-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    24/12/2024, 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    105826ea06552e2df460ba061208b80156e6e1583b36954aecd9d19cf621c4b0.apk

  • Size

    1.9MB

  • MD5

    e025df6f6fd4fb2ddb0e2fb578187ddd

  • SHA1

    00f6f090e0e9007b5bfeb79ae83aa2ed33efbf9f

  • SHA256

    105826ea06552e2df460ba061208b80156e6e1583b36954aecd9d19cf621c4b0

  • SHA512

    6bf7463434e582caa7b30b4d0f7490338399250fabd301b8b0913d030d4e5766a7f3eb30ac0b336646cfcddf4f0bb32cf62ba95606be3b974bb5b7d004d86490

  • SSDEEP

    49152:Cj7jvlXLnXQuihAFtwflNvR/g0J08016fljXOykIdcl1dIpkJpRD51O:CTvhgmAd/nXOJaMp1O

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasioninfostealerpersistenceratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://5.161.217.34/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.axis.author
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4216
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.axis.author/app_DynamicOptDex/lpNH.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.axis.author/app_DynamicOptDex/oat/x86/lpNH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4243

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.axis.author/app_DynamicOptDex/lpNH.json
    Filesize

    54KB

    MD5

    e0d3da80b60a7bb13dbdf77350f0c909

    SHA1

    01b1408f02bbe4aac418e5391d9ace0845db07c1

    SHA256

    c6077765a049f17719837d2d8cbc77b8a65a1f749450a564268a07f32460db1b

    SHA512

    0256b09bd285f41cbb5ad087445d907f7714a211749d9563d9c0020a0162e1b0a8de99a2d12e1951a91983486893726328295e6cb753df8396bbc0a86f27ab97

    Download Submit

  • /data/data/com.axis.author/app_DynamicOptDex/lpNH.json
    Filesize

    54KB

    MD5

    0cd70b0f2d0744fb0bd672e7b86dda63

    SHA1

    36d57e21fdb4c81a94b3c24a5f87ce12d0e2678b

    SHA256

    36d5ad5d4a712657a9685a485c94c14cb3363a063b538b3a2db2abf643cb5162

    SHA512

    d6a9effa7b7a5e7123af670cfb14526eecc5d2fed2125eafe0fb169aa17ee045636bf5d9196397b37fbc46f9752a2ebd5a81c5dfa012a9e8f2104b143168f381

    Download Submit

  • /data/data/com.axis.author/app_DynamicOptDex/oat/lpNH.json.cur.prof
    Filesize

    829B

    MD5

    9971db96de8cac7e91f68ca5aca39f07

    SHA1

    abcdf790f08cc91331393bae8e26adfd8bff28e5

    SHA256

    4644487f0824e8d614c3a7eb561c9b874ec5437258b8c34cbc59bcb9e256e7fd

    SHA512

    b257eb6aebe981b570a11ae793f73f347fdc0b99d9717c3ef2dc2ee59798c294322a6975621693c96eb0344ece14b5e0cc61eb1110dc34dce66ca2fb0735f0b0

    Download Submit

  • /data/user/0/com.axis.author/app_DynamicOptDex/lpNH.json
    Filesize

    103KB

    MD5

    947bc04d718c1f27a5d4270186ec1138

    SHA1

    f9decb777e9eb21f4c915de17b3853b9155d46ab

    SHA256

    42b0539de0cb68fadec82bf3ee13227a3738e3279b0b79ef7bbbc9add2e2975a

    SHA512

    9c30d5889138270befbbfdcd5fd89182ceb3de5b8b2c159ad2dacab4ad23e11ecf9b7aff3e48aef0098dd2720ce9deb21077c7cdb64dd0457af460d319a5dc72

    Download Submit

  • /data/user/0/com.axis.author/app_DynamicOptDex/lpNH.json
    Filesize

    103KB

    MD5

    8da650234783dbfb5c1ad2b30c423bd4

    SHA1

    2d0e71af37e0434f980835ee79b9baeb6d447dcd

    SHA256

    843f59e77ed4ff7037af84c868831b4744ca68e25ab5d3ea6d3119fc48f60b2a

    SHA512

    e6f9dbc9a4a896edf09d77b2bc87a6f235a848a29f12123d654eef99b43595f335efb02c2a51cb1df333338fa3e6b17c1ca958285e091d30f5194b6feaf68bcb

    Download Submit