General
-
Target
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932.bin
-
Size
1.6MB
-
Sample
240807-11m7yaycra
-
MD5
c60da6d1e301b79a510bf49fb3c20b3d
-
SHA1
339fd4f68724054fe1e129a87564e834af0042e8
-
SHA256
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932
-
SHA512
00c7d735f18bf995ee8ad0e09b51eb93d6f5d6034b6734f762c9666662e00cbcfde8f50fa3d087a2dd59233711acb41bfefd86dcecae091f2b2eabaa46928491
-
SSDEEP
49152:dih/BBuG+0gPMhReFCd9d7uFrtE3fL1mylemXWhLpAv:dih/B0GrJr7KC3fLdemmDC
Static task
static1
Behavioral task
behavioral1
Sample
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
cerberus
http://94.250.253.26
Targets
-
-
Target
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932.bin
-
Size
1.6MB
-
MD5
c60da6d1e301b79a510bf49fb3c20b3d
-
SHA1
339fd4f68724054fe1e129a87564e834af0042e8
-
SHA256
166468ee1b8cbd35247871ddbde9e2324a7dd6dce40967687ce134aafaca2932
-
SHA512
00c7d735f18bf995ee8ad0e09b51eb93d6f5d6034b6734f762c9666662e00cbcfde8f50fa3d087a2dd59233711acb41bfefd86dcecae091f2b2eabaa46928491
-
SSDEEP
49152:dih/BBuG+0gPMhReFCd9d7uFrtE3fL1mylemXWhLpAv:dih/B0GrJr7KC3fLdemmDC
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices)
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Requests changing the default SMS application.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Tries to add a device administrator.
-
Listens for changes in the sensor environment (might be used to detect emulation)
-
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1