Resubmissions

10/03/2025, 05:30

250310-f7nf3avjs710

09/11/2024, 01:30

241109-bwtfqathrc10

08/11/2024, 23:26

241108-3exwcsvmbk10

General

  • Target
    7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.bin
  • Size 1.9MB
  • Sample241109-bwtfqathrc
  • SHA256 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cerberus

C2
  • http://mtrfff.ru/

Targets

    • Target
      7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.bin
    • Size 1.9MB
    • SHA256 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889
    • MD5 SHA1 SHA512 SSDEEP
    • Cerberus

      An Android banker that is being rented to actors beginning in 2019.

    • Cerberus family

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries the phone number (MSISDN for GSM devices)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Requests changing the default SMS application.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Requests enabling of the accessibility settings.

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks