{
	"id": "2f7619e6-1e79-4fe7-b3bd-4802d914b187",
	"created_at": "2026-04-06T00:10:22.971876Z",
	"updated_at": "2026-04-10T03:30:32.794917Z",
	"deleted_at": null,
	"sha1_hash": "11058962f190cd505422199abba73d6b2caf606a",
	"title": "Catelites (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 32638,
	"plain_text": "Catelites (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 19:15:49 UTC\r\nCatelites\r\nCatelites Bot (identified by Avast and SfyLabs in December 2017) is an Android trojan, with ties to CronBot.\r\nOnce the malicious app is installed, attackers use social engineering tricks and window overlays to get credit card\r\ndetails from the victim.\r\nThe distribution vector seems to be fake apps from third-party app stores (not Google Play) or via malvertisement.\r\nAfter installation and activation, the app creates fake Gmail, Google Play and Chrome icons. Furthermore, the\r\nmalware sends a fake system notification, telling the victim that they need to re-authenticate with Google Services\r\nand ask for their credit card details to be entered.\r\nCurrently the malware has overlays for over 2,200 apps of banks and financial institutions.\r\nReferences\r\n2017-12-20 ⋅ Avast ⋅\r\nNew version of mobile malware Catelites possibly linked to Cron cyber gang\r\nCatelites\r\n2017-12-20 ⋅ YouTube ⋅ Avast\r\nVideo about Catelites Bot - Airbank Example\r\nCatelites\r\nThere is no Yara-Signature yet.\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/apk.catelites\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/apk.catelites\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/apk.catelites"
	],
	"report_names": [
		"apk.catelites"
	],
	"threat_actors": [
		{
			"id": "eb3f4e4d-2573-494d-9739-1be5141cf7b2",
			"created_at": "2022-10-25T16:07:24.471018Z",
			"updated_at": "2026-04-10T02:00:05.002374Z",
			"deleted_at": null,
			"main_name": "Cron",
			"aliases": [],
			"source_name": "ETDA:Cron",
			"tools": [
				"Catelites",
				"Catelites Bot",
				"CronBot",
				"TinyZBot"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "75108fc1-7f6a-450e-b024-10284f3f62bb",
			"created_at": "2024-11-01T02:00:52.756877Z",
			"updated_at": "2026-04-10T02:00:05.273746Z",
			"deleted_at": null,
			"main_name": "Play",
			"aliases": null,
			"source_name": "MITRE:Play",
			"tools": [
				"Nltest",
				"AdFind",
				"PsExec",
				"Wevtutil",
				"Cobalt Strike",
				"Playcrypt",
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434222,
	"ts_updated_at": 1775791832,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/11058962f190cd505422199abba73d6b2caf606a.pdf",
		"text": "https://archive.orkl.eu/11058962f190cd505422199abba73d6b2caf606a.txt",
		"img": "https://archive.orkl.eu/11058962f190cd505422199abba73d6b2caf606a.jpg"
	}
}