General
- Target 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.bin
- Size 1.9MB
- Sample241109-bwtfqathrc
- SHA256 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889
- MD5 8f582084127a364695aa007925f74065
- SHA1 62a27bbacee4314e3fbf99777f3be0eb4c30b158
- SHA512 79b718cddecb321eee1464d54a32398690acc92c88faf0dec2a44fe23dce606382fdf033b3542c913ccd35174a78ffd466b246a38e4da0505da91ef8f3957d08
- SSDEEP 49152:D68Y3e+Cj1Z9KoKndF0KP0J0801fjSRZg/60dmcl1dIpkJgRh5HH:D68b+IZKbjSM60CMeHH
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
-
cerberus
-
http://mtrfff.ru/
Targets
-
- Target 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889.bin
- Size 1.9MB
- SHA256 7ddaa67b5227cfd414b1f55c51f1ed8818ac995ec9670893ee01804686203889
- MD5 8f582084127a364695aa007925f74065
- SHA1 62a27bbacee4314e3fbf99777f3be0eb4c30b158
- SHA512 79b718cddecb321eee1464d54a32398690acc92c88faf0dec2a44fe23dce606382fdf033b3542c913ccd35174a78ffd466b246a38e4da0505da91ef8f3957d08
- SSDEEP 49152:D68Y3e+Cj1Z9KoKndF0KP0J0801fjSRZg/60dmcl1dIpkJgRh5HH:D68b+IZKbjSM60CMeHH
- MD5 SHA1 SHA512 SSDEEP
Cerberus family
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Queries the phone number (MSISDN for GSM devices)
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
Queries the mobile country code (MCC)
Requests changing the default SMS application.
Requests disabling of battery optimizations (often used to enable hiding in the background).
Requests enabling of the accessibility settings.
Listens for changes in the sensor environment (might be used to detect emulation)
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1