Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
159s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
17/01/2025, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk
-
Size
1.3MB
-
MD5
e7ec59ef18185b1296a71ccc0e77ddcc
-
SHA1
c6a21a11d192b1e11a8d9556aaf1b42bcbfda959
-
SHA256
14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136
-
SHA512
2f27d381a7c288cb09177e52c07ff1a1276d929db66ebe95aaff1a42b55eed4b8bbfd5815a887f4b8860c2456ad2f065bd95f379c4ed2e9996539e704cb920f2
-
SSDEEP
24576:CnQQRsClfdZTrGeXKCCdQuKc/XsRN8baXY9c2p5jjpeQqQLTAC+PGZsgK:CnQCXdZ+5xdocEPIc2rBeQqCAC+uZbK
Malware Config
Extracted
cerberus
http://194.34.232.172
Signatures
-
Cerberus family
-
pid Process 4790 com.seminar.goddess -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json 4790 com.seminar.goddess [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json] 4790 com.seminar.goddess [anon:dalvik-classes.dex extracted in memory from /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json] 4790 com.seminar.goddess -
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.seminar.goddess Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.seminar.goddess -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.seminar.goddess -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
ioc Process android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.seminar.goddess android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.seminar.goddess android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.seminar.goddess android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction com.seminar.goddess -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.seminar.goddess -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.seminar.goddess -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.seminar.goddess -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.seminar.goddess -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.seminar.goddess
Processes
-
com.seminar.goddess1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
PID:4790
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ed6c57c0e237f9abe38551da30c30817
SHA1cac0e5e44338e615c4784dd7725935a5ccb161f5
SHA2560e62e5afd9a69eda37e1c31dfc139f24fa14be21cc399e1dc3e3cbec0ab8ae91
SHA512f4b7cad3affeb76361bd43461fa19bbf240de2674a89a79437486a258e27b344ae54bb2c1c6085b01955592f732db6391245bcb6159d0e03315b2c2907f6de5b
-
Filesize
64KB
MD5d66a986126aa432d0238743d63da7fff
SHA1998b7b2efb9d2642905157dd4fe9262fc47852d6
SHA256ecfd243589d7d07dbdb062ecf0a371217c5147a40d2ba0ed0e62732384304b85
SHA5126cb0ac8bd8d351e64e13db5c7a37c870076d0bbfb66426dac33da7adb7279ef74ab51b612fee0c91f3e8eaeadaa9ff79c25a786be410db3561b4784317bd6ca0
-
Filesize
148B
MD57e6952dcb1833580023107d6f7f07cd1
SHA17dded2c82d81646d1fec8aed7ca533960c911a45
SHA256a03c42e31bf4c7b5049d1af35685ee9cd516f43ed13edf72a473ed2a0df47b3f
SHA512b10f87f6f8bd95c1df0e09822080358b4f31e3bd2c4f8fcb60d3212ce3b0647304aa46c2360e9a5317367e1db00de01d5a6cc6b242aa4e0548306a8703b36f0b
-
Filesize
125KB
MD56092cd2231b2240ad0c7a40e27f78be4
SHA1cb7da358a44185b821d83985d2e2735a6d82433c
SHA2566eed1a37fafbd5d4966671142703d91950bc065d89e207ac46e21ea95fdd0a9a
SHA512ededc0b10f34490c9ddccd4cefed37afa0850a2fa38ef3f7878090ba4e94b807a737d82d79999024d48dc35644d8153a9f83569bd4357c2cbf4dbf29cf570d81