A new Android malware called Cerberus is being used for malicious purposes whose code is written from scratch, independent of all existing banking Trojans. Oddly, the malware is also being advertised on Twitter using the handle @AndroidCerberus.
Along with the standard payload and string obfuscation, it uses a new technique to prevent analysis. It uses the device accelerometer sensor to implement a pedometer and measures movements of the victim. When victims move around, the Trojan detects increased step count and activates the bot. If the step counter hits the pre-configured threshold it considers running on the device to be safe. Therefore, the Trojan does not run on test devices of malware analysts and evades dynamic analysis environments and sandboxes.
When the malware is first started on the device it will begin by hiding its icon from the application drawer. Then it will ask for the accessibility service privilege. After the user grants the requested privilege, Cerberus starts to abuse it by granting itself additional permissions, such as permissions needed to send messages and make calls, without requiring any user interaction. It also disables Play Protect (Google’s preinstalled antivirus solution) to prevent its discovery and deletion in the future. After conveniently granting itself additional privileges and securing its persistence on the device, Cerberus registers the infected device in the botnet and waits for commands from the C2 server while making use of overlay attacks, SMS control and contact list harvesting. The Trojan can also leverage keylogging. Following features are found in the Trojan:
The target list is so far limited to the following apps, but is expected to grow soon. Targeted applications are listed in the Affected Products section of this advisory.
7 French banking apps
7 U.S. banking apps
1 Japanese banking app
15 non-banking apps
Malware Hash (MD5/SHA1/SH256)