Rewterz Threat Alert – Cerberus – A new Banking Trojan being sold as Android Malware

Severity

Medium

Analysis Summary

A new Android malware called Cerberus is being used for malicious purposes whose code is written from scratch, independent of all existing banking Trojans. Oddly, the malware is also being advertised on Twitter using the handle @AndroidCerberus. 

Along with the standard payload and string obfuscation, it uses a new technique to prevent analysis. It uses the device accelerometer sensor to implement a pedometer and measures movements of the victim. When victims move around, the Trojan detects increased step count and activates the bot.  If the step counter hits the pre-configured threshold it considers running on the device to be safe. Therefore, the Trojan does not run on test devices of malware analysts and evades dynamic analysis environments and sandboxes. 

When the malware is first started on the device it will begin by hiding its icon from the application drawer. Then it will ask for the accessibility service privilege. After the user grants the requested privilege, Cerberus starts to abuse it by granting itself additional permissions, such as permissions needed to send messages and make calls, without requiring any user interaction. It also disables Play Protect (Google’s preinstalled antivirus solution) to prevent its discovery and deletion in the future. After conveniently granting itself additional privileges and securing its persistence on the device, Cerberus registers the infected device in the botnet and waits for commands from the C2 server while making use of overlay attacks, SMS control and contact list harvesting. The Trojan can also leverage keylogging. Following features are found in the Trojan: 

• Overlaying: Dynamic (Local injects obtained from C2)
• Keylogging
• SMS harvesting: SMS listing
• SMS harvesting: SMS forwarding
• Device info collection
• Contact list collection
• Application listing
• Location collection
• Overlaying: Targets list update
• SMS: Sending
• Calls: USSD request making
• Calls: Call forwarding
• Remote actions: App installing
• Remote actions: App starting
• Remote actions: App removal
• Remote actions: Showing arbitrary web pages
• Remote actions: Screen-locking
• Notifications: Push notifications
• C2 Resilience: Auxiliary C2 list
• Self-protection: Hiding the App icon
• Self-protection: Preventing removal
• Self-protection: Emulation-detection
• Architecture: Modular

The target list is so far limited to the following apps, but is expected to grow soon. Targeted applications are listed in the Affected Products section of this advisory. 

7 French banking apps 
7 U.S. banking apps 
1 Japanese banking app 
15 non-banking apps

Impact

• Information Disclosure
• Credential Theft
• Financial Loss

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

• 1512c3fa688ca107784b3c93cd9f3526
• 61272b695a6fc8b6bc31c217e0cd6766

Affected Products

• Play Market
• Boursorama Banque
• Banque
• Chase Mobile
• Fifth Third Mobile Banking
• Connect for Hotmail
• Gmail
• imo free video calls and chat
• Bank of America Mobile Banking
• ING
• Instagram
• Capital One® Mobile
• mail.com mail
• Microsoft Outlook
• Snapchat
• WeChat
• Twitter
• Uber
• USAA Mobile
• U.S. Bank – Inspired by customers
• Viber
• Wells Fargo Mobile
• WhatsApp
• Yahoo Mail – Organized Email
• Banque Populaire
• Ma Banque
• L’Appli Société Générale
• Mes Comptes BNP Paribas
• Telegram

Remediation

• Since the Trojan uses social engineering to be installed on your device, avoid downloading unnecessary applications.
• Do not download software/applications from untrusted sources.
• Be careful while granting permissions to applications and specially avoid allowing accessibility service privilege permissions, when not needed.
• Ensure that Play Protect is running normally on your device and always look for suspicious or unusual activity.
• Always update these applications to the latest available versions, (in case vendors introduce mitigation updates against exploitation of these applications.)