Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    49s
  • max time network
    159s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    17/01/2025, 22:01

General

  • Target

    14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136.apk

  • Size

    1.3MB

  • MD5

    e7ec59ef18185b1296a71ccc0e77ddcc

  • SHA1

    c6a21a11d192b1e11a8d9556aaf1b42bcbfda959

  • SHA256

    14a05dab2a8dce7d407cc8878927a1b7dcf5dff9078fcef6783f151663573136

  • SHA512

    2f27d381a7c288cb09177e52c07ff1a1276d929db66ebe95aaff1a42b55eed4b8bbfd5815a887f4b8860c2456ad2f065bd95f379c4ed2e9996539e704cb920f2

  • SSDEEP

    24576:CnQQRsClfdZTrGeXKCCdQuKc/XsRN8baXY9c2p5jjpeQqQLTAC+PGZsgK:CnQCXdZ+5xdocEPIc2rBeQqCAC+uZbK

Malware Config

Extracted

Family

cerberus

C2

http://194.34.232.172

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

  • Cerberus family
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.seminar.goddess
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4790

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.seminar.goddess/app_DynamicOptDex/Theo.json

    Filesize

    64KB

    MD5

    ed6c57c0e237f9abe38551da30c30817

    SHA1

    cac0e5e44338e615c4784dd7725935a5ccb161f5

    SHA256

    0e62e5afd9a69eda37e1c31dfc139f24fa14be21cc399e1dc3e3cbec0ab8ae91

    SHA512

    f4b7cad3affeb76361bd43461fa19bbf240de2674a89a79437486a258e27b344ae54bb2c1c6085b01955592f732db6391245bcb6159d0e03315b2c2907f6de5b

  • /data/data/com.seminar.goddess/app_DynamicOptDex/Theo.json

    Filesize

    64KB

    MD5

    d66a986126aa432d0238743d63da7fff

    SHA1

    998b7b2efb9d2642905157dd4fe9262fc47852d6

    SHA256

    ecfd243589d7d07dbdb062ecf0a371217c5147a40d2ba0ed0e62732384304b85

    SHA512

    6cb0ac8bd8d351e64e13db5c7a37c870076d0bbfb66426dac33da7adb7279ef74ab51b612fee0c91f3e8eaeadaa9ff79c25a786be410db3561b4784317bd6ca0

  • /data/data/com.seminar.goddess/app_DynamicOptDex/oat/Theo.json.cur.prof

    Filesize

    148B

    MD5

    7e6952dcb1833580023107d6f7f07cd1

    SHA1

    7dded2c82d81646d1fec8aed7ca533960c911a45

    SHA256

    a03c42e31bf4c7b5049d1af35685ee9cd516f43ed13edf72a473ed2a0df47b3f

    SHA512

    b10f87f6f8bd95c1df0e09822080358b4f31e3bd2c4f8fcb60d3212ce3b0647304aa46c2360e9a5317367e1db00de01d5a6cc6b242aa4e0548306a8703b36f0b

  • /data/user/0/com.seminar.goddess/app_DynamicOptDex/Theo.json

    Filesize

    125KB

    MD5

    6092cd2231b2240ad0c7a40e27f78be4

    SHA1

    cb7da358a44185b821d83985d2e2735a6d82433c

    SHA256

    6eed1a37fafbd5d4966671142703d91950bc065d89e207ac46e21ea95fdd0a9a

    SHA512

    ededc0b10f34490c9ddccd4cefed37afa0850a2fa38ef3f7878090ba4e94b807a737d82d79999024d48dc35644d8153a9f83569bd4357c2cbf4dbf29cf570d81