Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

ee6073c70f...cd.apk

android-9-x86

10

ee6073c70f...cd.apk

android-10-x64

10

ee6073c70f...cd.apk

android-11-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    144s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    17/01/2025, 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee6073c70f9a0e17bae4ade995f7d6d3a0b8b9a1b19aaffb73039b94196043cd.apk

  • Size

    1.5MB

  • MD5

    da1f40de0c3a83308132236761e343fa

  • SHA1

    300af550a894f19954bf0e89b17c42518a62ffed

  • SHA256

    ee6073c70f9a0e17bae4ade995f7d6d3a0b8b9a1b19aaffb73039b94196043cd

  • SHA512

    616760d9903e36273721cf7d52f4c208628c93eb49bfaaf21457579faed1ea3bb3a666348801de41c489aebded84d8cb9adf58837f9c6c90a3fe28d040ab393a

  • SSDEEP

    24576:P5f2WdRojRga4uV+GzWhRa6NnSyA69gALDBd//A0pMCMhr09SC3c9WXSpLB4/3DZ:P5QgNuQTHk0qar/8Bm9SGEjLKl

Score
10/10
cerberusbankercollectioncredential_accessdiscoveryevasionimpactinfostealerratstealthtrojan

Malware Config

Extracted

Family

cerberus

C2

http://62.109.13.217/

Signatures

  • Cerberus

    An Android banker that is being rented to actors beginning in 2019.

    bankertrojaninfostealerevasionratcerberus
  • Cerberus family
    cerberus
  • Removes its main activity from the application launcher 1 TTPs 2 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
    collectionimpact
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.spawn.hen
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Performs UI accessibility actions on behalf of the user
    • Requests changing the default SMS application.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Checks CPU information
    • Checks memory information
    PID:4625

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

3
T1628

Suppress Application Icon

1
T1628.001

User Evasion

2
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

1
T1636

SMS Messages

1
T1636.004

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

SMS Control

1
T1582

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.spawn.hen/app_DynamicOptDex/oat/tDMCAw.json.cur.prof
    Filesize

    149B

    MD5

    d7b0938f8d7acfddf0b57e4db1f06806

    SHA1

    8332dae9b44848634d33767484c382f586da1c85

    SHA256

    4f86515c3f5156ae29f6a1e182d08631b3fecd374674ea444941d53c8115ff26

    SHA512

    fe399e3788301fa83790e6cf8b76164be7b6880c1aa46ec451e76e360aff3733e6ea15ab998871cc8aba8e54d446e0a20b7529ba886220d59ff46517059d432d

    Download Submit

  • /data/user/0/com.spawn.hen/app_DynamicOptDex/tDMCAw.json
    Filesize

    64KB

    MD5

    7bc199cd2d2cad4084b00bcdbdcabd47

    SHA1

    4db3d2f3061de590a3f68d1d887dfb12c95220d5

    SHA256

    e42ab0a079d71bb4ba70b09f11449318b8b098e70ce5d16e41fa416a8364c2e5

    SHA512

    fd483cfed692d9ac5ed326210b30f97638ab3f412e21b579cf21eb5110c216ea536c005932fde4ba1d933e4bdaf3199502f9b6d110e159f34ac9e767d9a4696a

    Download Submit

  • /data/user/0/com.spawn.hen/app_DynamicOptDex/tDMCAw.json
    Filesize

    64KB

    MD5

    a3272bf2e1aa3053474b57d4d58908a7

    SHA1

    759a108dddbb5ba0bc6437f11da7c6734a59eb61

    SHA256

    32e44455258e32a49b08c26cc2581a9911d254fabf95e570c57bfcc6ccf511c8

    SHA512

    d1a251f1ba98f5071186e8dfe2848d3323dd919ccd061a1e6b0bbf93d80a36315d22963eb5047e6489c9242d91d522dc763b6686eb90200759b0ea7002058c67

    Download Submit

  • /data/user/0/com.spawn.hen/app_DynamicOptDex/tDMCAw.json
    Filesize

    118KB

    MD5

    4c547b8533f6d0c8b84a52f8fbc4ad13

    SHA1

    d8be8c20aca6d7a9348e221ad213555afcddb7e6

    SHA256

    02d27d45c00f8af66aa0137dea77072fba44d0fe2aa6dd7d09106442df9e805d

    SHA512

    6e1de7950ef6df1b0fe088d74b225fed8097abc917bf37ef9305fed5261b3908d3907ce37cd8a0dbb72f7d5e3f4dc231892853914b6077d659fee9d8d9a6f151

    Download Submit