• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – KONNI APT Group – Active IOCs
August 24, 2021
Rewterz Threat Advisory – CVE-2021-33191 – Apache NiFi MiNiFi C++ Vulnerability
August 25, 2021

Rewterz Threat Alert – Cerberus Banking Trojan – Active IOCs

August 24, 2021

Severity

High

Analysis Summary

A recent analysis of the Cerberus banking Trojan, performed by Anomali, delves into its current capabilities, including the current malware-as-a-service activity associated with the malware. Cerberus is sold as a malware-as-a-service, likely to fill the gap of black market Android Trojans created when the sale of the Anubis and Red Alert malware ceased. Code analysis led researchers to the conclusion that this family does not share code with other Android banking Trojans and, thus, appears to be newly written. A user named Android is advertising the malware via the XSS.is hacking forum and Twitter. Purchasers of the malware-as-a-service receive access to a control panel for monitoring and control their bots, an APK builder, and an inject generator. Once installed on a victim device, the operators are able to send and intercept SMS messages, open fake login pages, get system information, perform injects, and many other capabilities. One of the most significant capabilities of Cerberus is the SMS functionality as it allows operators to intercept multi-factor authentication codes for accounts using SMS as an additional authentication factor. Overlays used for traditional banking Trojan credential-stealing purposes included those targeting banking, e-commerce, fin-tech, and telecommunication organizations globally.

Impact

  • Credential Theft
  • Financial Loss

Indicators of Compromise

Domain Name

  • merdaneferdane[.]xyz

MD5

  • 9e99e0232567b19ec3e1cf763cdc5ef0

SHA-256

  • 1ca86bc9060a5a18bc7125be12eeccf88f7a812480d351254b5e19e838536dbd

SHA-1

  • 0cea6346cfeaebeec3153102d96db22d97e18748

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.