General
-
Target
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e.bin
-
Size
1.4MB
-
Sample
240810-2134tsxbkc
-
MD5
eca3407f98415c4f08d658bd9d79baed
-
SHA1
a1ed126ec9958155b412ed167595e7ae3be6244e
-
SHA256
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e
-
SHA512
9d13611e58fe4a2efb5edef6f338683bc79fb28f061ce152a75ee72258a41273ffafaa40075c95d37960a11d47484af3c8cbb2c415cad9b82948322832a4d40b
-
SSDEEP
24576:tzsb6yn1n28BlCg1RtpLdJe/Ffkhy9ZyR3LrSAKemosWhWmCp:mDn12wlCg95dJuFfxIR3LrSDemJWhLCp
Static task
static1
Behavioral task
behavioral1
Sample
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
cerberus
http://80.87.192.227
Targets
-
-
Target
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e.bin
-
Size
1.4MB
-
MD5
eca3407f98415c4f08d658bd9d79baed
-
SHA1
a1ed126ec9958155b412ed167595e7ae3be6244e
-
SHA256
46e69506350d4654dc3c9b1eab693e4a93d5a11b5dd152d3b46deadc94104a6e
-
SHA512
9d13611e58fe4a2efb5edef6f338683bc79fb28f061ce152a75ee72258a41273ffafaa40075c95d37960a11d47484af3c8cbb2c415cad9b82948322832a4d40b
-
SSDEEP
24576:tzsb6yn1n28BlCg1RtpLdJe/Ffkhy9ZyR3LrSAKemosWhWmCp:mDn12wlCg95dJuFfxIR3LrSDemJWhLCp
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices)
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Tries to add a device administrator.
-
Listens for changes in the sensor environment (might be used to detect emulation)
-
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1