{"id":26358,"date":"2020-08-15T12:02:03","date_gmt":"2020-08-15T06:32:03","guid":{"rendered":"https:\/\/www.technologyforyou.org\/?p=26358"},"modified":"2020-08-15T12:02:03","modified_gmt":"2020-08-15T06:32:03","slug":"the-rise-reign-and-fall-of-cerberus-banking-trojan","status":"publish","type":"post","link":"https:\/\/www.technologyforyou.org\/the-rise-reign-and-fall-of-cerberus-banking-trojan\/","title":{"rendered":"The Rise, Reign and Fall of Cerberus Banking Trojan"},"content":{"rendered":"

By AVAR (Association of anti-Virus Asia Researchers)<\/span><\/strong><\/span><\/p>\n

Being one of the most popular computing platforms ever, Android has essentially become a sweet spot for cybercriminals. In the contemporary digital fraternity, where security has become almost a myth, the service and platform providers as well as the users need to expend continuous efforts to keep data secure from prying eyes.<\/span><\/p>\n

However, the adversaries also expend similar (if not more) efforts to identify and\/or track vulnerabilities, 0-days and otherwise, to exploit.<\/span><\/p>\n

The Rise<\/strong><\/span><\/p>\n

Let\u2019s take Cerberus for example, one of the prevalent Android Trojans as of a few months ago. Offered as Malware-as-a-Service (MaaS) and advertised using flashy banners on the dark web to captivate a significant number of buyers, Cerberus has been available on a subscription basis at almost \u201ccompelling\u201d rates. An evil-minded individual could avail the service at a discounted price and enjoy constant support from the social-media friendly developer.<\/span><\/p>\n

Cerberus, a sophisticated Android Trojan with self-propagating abilities mostly used for eliciting banking and financial credentials, gets installed on the victim\u2019s device via numerous campaigns.<\/span><\/p>\n

Researchers at K7 Labs spotted a minacious strain of this Android Trojan in the wild masquerading as a COVID-19 tracker app. And their investigations revealed several interesting facts about this variant of the malware, especially from an Indian context. Earlier strains of Cerberus were targeting over 250 banking and cryptocurrency applications from the United States, France, Italy, Turkey, and Japan.<\/span><\/p>\n

This variant was however found to be targeting several large Indian banking institutions (including Axis Bank, ICICI Bank, Indian Bank, ING Bank, HDFC Bank, and Bank of Baroda) by way of not-so-ingenious\u00a0techniques.<\/span><\/p>\n

\"\"<\/span><\/figure>\n

The Reign<\/strong><\/span><\/p>\n

Once installed on the target device, the malware uses the Flash Player icon as its own for the first launch, after which it goes into stealth mode by hiding its icon from the application drawer.<\/span><\/p>\n

Soon after installation, it continually brings up the accessibility settings option on the device until the user enables it. For the uninitiated, apps having the accessibility settings turned on could carry out numerous functions in the background that could be used to track the user\u2019s activities.<\/span><\/p>\n

Interestingly, it also tries to evade the Google Play Protect constant scan by disabling the\u00a0\u201cGoogle Play Protect\u201d\u00a0<\/strong>service.<\/span><\/p>\n

Thus comfortably settled in, the malicious app monitors the device to see if any of the targeted applications are being launched.<\/span><\/p>\n

And when that happens, it launches a screen overlay attack: it opens up a fake login screen, a look-alike of the actual app the user intended to open, prompting the unsuspecting user to enter their credentials.<\/span><\/p>\n

This variant comes with a key-logger functionality that can record keystrokes and sounds. So when the user types in their financial credentials, it tracks every key tapped and sounds, and saves them into a log file called\u00a0keys.log<\/em>.<\/span><\/p>\n

\"\"<\/span><\/figure>\n

Moreover, it lists all the installed packages on the infected device and forwards the list, along with all the other stolen information, back to its C2 (Command-and-Control) server(s).<\/span><\/p>\n

In addition to the above tasks, the malware is also capable of the following malicious activities:<\/span><\/strong><\/span><\/p>\n

    \n
  • Collecting device information<\/span><\/li>\n
  • Downloading additional payloads<\/span><\/li>\n
  • Removing other installed apps<\/span><\/li>\n
  • Stealing contact lists<\/span><\/li>\n
  • Sending, receiving and deleting SMS<\/span><\/li>\n
  • Taking screenshots<\/span><\/li>\n
  • Forwarding calls<\/span><\/li>\n
  • Locking device display<\/span><\/li>\n<\/ul>\n

    Our researchers also found that this piece of malicious code comes with Remote Access Trojan (RAT) functionality from a RAT Service, and it awaits a hardcoded list of commands from its C2 server(s). The command list includes:<\/strong><\/span><\/span><\/p>\n

      \n
    • opendir<\/span><\/li>\n
    • startscreenVNC<\/span><\/li>\n
    • stopscreenVNC<\/span><\/li>\n
    • downloadfile<\/span><\/li>\n
    • startsound<\/span><\/li>\n<\/ul>\n

      More recent variants of the malware have aimed to exfiltrate credit card data stored on the device and have been noticed to use SQLite database for storing the stolen information.<\/span><\/p>\n

      Also, to evade detection all the strings in this variant were base64 encoded and the resulting decoded strings are RC4 encrypted strings with a decryption key specific to each string. Interestingly, each encrypted string has its unique RC4 decryption key prepended as the first 6 bytes of the encrypted string.<\/span><\/p>\n

      The Fall<\/strong><\/span><\/p>\n

      Fortunately, the mayhem of Cerberus is expected to be short-lived thanks to a purported breaking up of the team which resulted in their inability to \u201csupport their product\u201d, and its developer(s) have since reportedly put their wares, so to speak (source code, admin panel, servers, active customer lists, etc.), on auction for USD 50,000 or a final deal price of USD 100,000.<\/span><\/p>\n

      Of course, the postlude doesn\u2019t necessarily mean their evil aura is gone forever. Cerberus\u2019s ending might be a new beginning for another, maybe a more severe malware, as the future buyer(s) could make a comeback, or worse add more sinister features to it to create havoc in the coming months.<\/span><\/p>\n

      So in conclusion, these attacks are going to keep coming in different avatars, each new one probably more sophisticated (or in the very least more unscrupulous) than the ones before. And here are some tips to best protect your device and data:<\/span><\/p>\n

        \n
      • Install a robust security product for Android, like K7 Mobile Security, and ensure it is kept up-to-date<\/span><\/li>\n
      • Keep your devices updated and patched for the latest security vulnerabilities<\/span><\/li>\n
      • Be vigilant about what you download, and where you download them from; exercise caution even while installing apps from the official App Store<\/span><\/li>\n
      • Disable \u201cInstall unknown apps\u201d option on your Android device, never download apps from 3rd<\/sup>\u00a0party app stores<\/span><\/li>\n
      • Check app permissions during installation and abort if unnecessary privileges are requested<\/span><\/li>\n
      • Do not click on links in SMS and emails, especially if you do not know the sender<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

        By AVAR (Association of anti-Virus Asia Researchers) Being one of the most popular computing platforms ever, Android has essentially become a sweet spot for cybercriminals. In the contemporary digital fraternity, where security has become almost a myth, the service and platform providers as well as the users need to expend continuous efforts to keep data […]<\/p>\n","protected":false},"author":1,"featured_media":26359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[6217,13617],"class_list":{"0":"post-26358","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security","8":"tag-association-of-anti-virus-asia-researchers","9":"tag-cerberus-banking-trojan"},"_links":{"self":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/posts\/26358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/comments?post=26358"}],"version-history":[{"count":0,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/posts\/26358\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/media\/26359"}],"wp:attachment":[{"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/media?parent=26358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/categories?post=26358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.technologyforyou.org\/wp-json\/wp\/v2\/tags?post=26358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}