Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

14a05dab2a...36.apk

android-9-x86

10

14a05dab2a...36.apk

android-10-x64

10

14a05dab2a...36.apk

android-11-x64

10

Analysis

  • max time kernel
    49s
  • max time network
    159s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    17/01/2025, 22:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk

  • Size

    1.3MB

  • MD5

    e7ec59ef18185b1296a71ccc0e77ddcc

  • SHA1

    c6a21a11d192b1e11a8d9556aaf1b42bcbfda959

  • SHA256

    14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136

  • SHA512

    2f27d381a7c288cb09177e52c07ff1a1276d929db66ebe95aaff1a42b55eed4b8bbfd5815a887f4b8860c2456ad2f065bd95f379c4ed2e9996539e704cb920f2

  • SSDEEP

    24576:CnQQRsClfdZTrGeXKCCdQuKc/XsRN8baXY9c2p5jjpeQqQLTAC+PGZsgK:CnQCXdZ+5xdocEPIc2rBeQqCAC+uZbK

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasionimpactinfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://194.34.232.172

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.seminar.goddess
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4790

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

3
T1628

Suppress Application Icon

1
T1628.001

User Evasion

2
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    64KB

    MD5

    ed6c57c0e237f9abe38551da30c30817

    SHA1

    cac0e5e44338e615c4784dd7725935a5ccb161f5

    SHA256

    0e62e5afd9a69eda37e1c31dfc139f24fa14be21cc399e1dc3e3cbec0ab8ae91

    SHA512

    f4b7cad3affeb76361bd43461fa19bbf240de2674a89a79437486a258e27b344ae54bb2c1c6085b01955592f732db6391245bcb6159d0e03315b2c2907f6de5b

    Download Submit

  • /data/data/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    64KB

    MD5

    d66a986126aa432d0238743d63da7fff

    SHA1

    998b7b2efb9d2642905157dd4fe9262fc47852d6

    SHA256

    ecfd243589d7d07dbdb062ecf0a371217c5147a40d2ba0ed0e62732384304b85

    SHA512

    6cb0ac8bd8d351e64e13db5c7a37c870076d0bbfb66426dac33da7adb7279ef74ab51b612fee0c91f3e8eaeadaa9ff79c25a786be410db3561b4784317bd6ca0

    Download Submit

  • /data/data/com.seminar.goddess/app_DynamicOptDex/oat/Theo.json.cur.prof
    Filesize

    148B

    MD5

    7e6952dcb1833580023107d6f7f07cd1

    SHA1

    7dded2c82d81646d1fec8aed7ca533960c911a45

    SHA256

    a03c42e31bf4c7b5049d1af35685ee9cd516f43ed13edf72a473ed2a0df47b3f

    SHA512

    b10f87f6f8bd95c1df0e09822080358b4f31e3bd2c4f8fcb60d3212ce3b0647304aa46c2360e9a5317367e1db00de01d5a6cc6b242aa4e0548306a8703b36f0b

    Download Submit

  • /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json
    Filesize

    125KB

    MD5

    6092cd2231b2240ad0c7a40e27f78be4

    SHA1

    cb7da358a44185b821d83985d2e2735a6d82433c

    SHA256

    6eed1a37fafbd5d4966671142703d91950bc065d89e207ac46e21ea95fdd0a9a

    SHA512

    ededc0b10f34490c9ddccd4cefed37afa0850a2fa38ef3f7878090ba4e94b807a737d82d79999024d48dc35644d8153a9f83569bd4357c2cbf4dbf29cf570d81

    Download Submit