Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
22/01/2025, 22:07
General
-
Target
8536a0771813f64f566e9f3a8cd8322bca2be35f9f0fe66fa5e400de55c5c9df.apk
-
Size
1.5MB
-
MD5
899ad24507005b6f265e14fb56fbe3a0
-
SHA1
d2f7d28e8a965dfe7664c54ea8982d2191be262f
-
SHA256
8536a0771813f64f566e9f3a8cd8322bca2be35f9f0fe66fa5e400de55c5c9df
-
SHA512
f08f041d37bad04fcc0f9df80c613dfc0946368af561f0dfd5bc34c3f11bfca4665f2902dc37a59977f85dbfbed6f449182778f67cd12541765cbbf29daf3ef3
-
SSDEEP
49152:aZJTiTskJxB4QvFFc29ApfxFmajL+hxf0:iTijJxnFFX9ADFmaGs
Malware Config
Extracted
cerberus
http://sapwatsuop.ru
Signatures
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus family
-
Removes its main activity from the application launcher 1 TTPs 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nut.choose1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Tries to add a device administrator.
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD527fddbd31b109ebaa8513315cfd73cc9
SHA1aba3de8e64cab9e9ccf060828006d536c5a266cc
SHA256dc33e20293d24634659b9452808ad7982b9b69697dca2d838c39b4362c76c3b1
SHA5121cb427b2fe4fe45aa72def500a1b942ef95e36c58c681e27edd4c5bb9c97093f5e3934ec7fb1ecf304a50efa6b0e3ca8f2c882560dad07816c0a5757aff55f0e
-
Filesize
64KB
MD541c1f795ef4ca6d89de7e25d9f73ffb7
SHA131eaeacc467a6270ba0aede7fbab2d9c4b23b1bb
SHA256cd0b15becebd2b30d6a46c150b0f146326109568a5babcef83adc89412723239
SHA5120cb2f92511ebedb09ab76ceab0c5f3adeb5d185eff14f8105e9a170f91adfff31853e66e89342bb663d611bf3c197a2885817bd2ede0fb0509468d890c46a7dd
-
Filesize
118KB
MD56ce4981964f8500b60a2e03ad9c6d449
SHA13276dd791664b38dc6524bc11132fde0c6e53e87
SHA2567226f32c8d167145bffae53471694806701c1b86df3e9f53df546ebf9a4d25a3
SHA5127fddbac8577c4427cece0095ad4d23445162d69785f2c5ab3f15feb186d0722229faa50fad58e8649b1237d4f98851d34be53ae7b2e1b6074b59ad65dcf73623
-
Filesize
152B
MD5484023a1b813e2d6e8a686dddb09a16f
SHA14257e3a582931351e8cb213e5d529a6f8c2ccaf4
SHA256c3ad4f65ab09c915e5ca82f35e0b5070be21b0b7afce9cf8bd37b0a0939f4d45
SHA5127a0b8db3ccac5626b0d64e756c7e6b3626143f3320b04a002818b80c4e434dc78d708685a198bfeda11074b09abf33d5f0d922cbcff880a0166a5b3734502eb6