General
-
Target
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.bin
-
Size
1.8MB
-
Sample
241114-1ys1eatfqe
-
MD5
e7e2f6d3f4dd11eaa700e91c5453c1fb
-
SHA1
ac4534de63725c1bf08e3eb0d069279e26dfffdb
-
SHA256
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b
-
SHA512
02e3f34a7073ceee74093fdefc2dc8a012e0d0c3d0c5cdc06ef5441ab54765d999a95b922bbe7315a90635f99e49f9b9e0f8331e35697123db5067609bb72db5
-
SSDEEP
49152:M7/1f6YGBpltmVDLth1DTXuFHE+2TLCBem2WhLHW:M7/IHmVn9TXKP2TLIemlY
Static task
static1
Behavioral task
behavioral1
Sample
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.apk
Resource
android-x64-arm64-20240624-en
Malware Config
Extracted
cerberus
http://94.250.253.26
Targets
-
-
Target
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b.bin
-
Size
1.8MB
-
MD5
e7e2f6d3f4dd11eaa700e91c5453c1fb
-
SHA1
ac4534de63725c1bf08e3eb0d069279e26dfffdb
-
SHA256
1ea104352c16532204692e8e508433b8cea31d9ac1b80bd5ae6360b0a00be78b
-
SHA512
02e3f34a7073ceee74093fdefc2dc8a012e0d0c3d0c5cdc06ef5441ab54765d999a95b922bbe7315a90635f99e49f9b9e0f8331e35697123db5067609bb72db5
-
SSDEEP
49152:M7/1f6YGBpltmVDLth1DTXuFHE+2TLCBem2WhLHW:M7/IHmVn9TXKP2TLIemlY
-
Cerberus family
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices)
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Requests changing the default SMS application.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Tries to add a device administrator.
-
Listens for changes in the sensor environment (might be used to detect emulation)
-
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
3Suppress Application Icon
1User Evasion
2Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1