MITRE ATT&CKsoftware (malware)
S1225 CherryBlos
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2025-06-25
Description
CherryBlos is an Android malware that steals credentials and redirects cryptocurrency to adversary-controlled wallets. CherryBlos was labelled Robot 999 in its first appearance in April 2023; since then, various aliases have been used, including GPTalk, Happy Miner, and SynthNet. The threat actors behind CherryBlos uploaded the malware to different Google Play regions, such as Malaysia, Vietnam, Indonesia, Philippines, Uganda, and Mexico.
Related
Uses · MITRE ATT&CK (13)
- T1660 Phishing technique
- T1655 Masquerading technique
- T1437.001 Web Protocols sub-technique
- T1629 Impair Defenses technique
- T1646 Exfiltration Over C2 Channel technique
- T1406.002 Software Packing sub-technique
- T1544 Ingress Tool Transfer technique
- T1541 Foreground Persistence technique
- T1417 Input Capture technique
- T1418 Software Discovery technique
- T1420 File and Directory Discovery technique
- T1424 Process Discovery technique
- T1453 Abuse Accessibility Features technique
References
- https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html TrendMicro_CherryBlos_July2023