Cerberus: recovered C2 indicators & analysis

What Cerberus is

Cerberus is an Android banking trojan first documented by ThreatFabric in June 2019 and advertised for rent on underground forums under a malware-as-a-service (MaaS) model. Its operators claimed the malware had been used in private operations for roughly two years beforehand, and unusually promoted the rental through a public social-media presence.

The malware abuses Android's accessibility service to read the package name of the foreground application and decide when to display a credential-stealing overlay window, and to grant itself additional permissions and disable protections such as Google Play Protect without user interaction. Reported targets included banking applications across several countries alongside email, social-media, messaging, and payment apps.

Later and test builds added two-factor-authentication theft, including capturing SMS-based one-time codes and reading Google Authenticator codes through the accessibility interface, together with a remote-access (RAT) capability and screen-lock credential grabbing intended to let operators unlock and control the device remotely.

To hinder analysis, some Cerberus samples used an accelerometer/step-counter (pedometer) check, activating only after detecting device movement so as to evade automated sandboxes and analyst test devices.

In August-September 2020, after a failed auction, the Cerberus author ended the rental service and released the full source code for free on a Russian-language underground forum; security vendors linked the release to a subsequent rise in infections. The leaked code became the basis for successor and fork families, including Alien, ERMAC, and Phoenix. (The TeamViewer-based RAT and notification sniffer are attributed by ThreatFabric to the Alien fork rather than to baseline Cerberus.)

Capabilities

• Overlay attacks (fake login windows) over banking and other apps to steal credentials and payment-card data
• Keylogging / capture of on-screen input
• Abuse of Android accessibility services to auto-grant permissions and drive the UI
• SMS interception, forwarding, and sending (SMS control)
• Theft of SMS-based one-time passwords / 2FA codes
• Theft of Google Authenticator codes via the accessibility interface
• Contact list harvesting
• Call forwarding via USSD codes
• Remote access / device control (RAT), including remote screen unlock in later/test builds
• Disabling Google Play Protect
• Anti-analysis via accelerometer/pedometer movement check
• HTTP-based command-and-control

Known C2 / channel types: Rented as malware-as-a-service on underground (Russian-language) forums; full source code later released publicly for free (2020), Distributed via sideloaded trojanized/fake apps, SMS phishing (smishing) for delivery, plus SMS interception/forwarding for exfiltration, HTTP command-and-control.

MITRE ATT&CK (Mobile)

Techniques commonly associated with Cerberus:

What Privara Unmask recovered

The packing was defeated (two DEX carved from memory) and the C2 recovered via runtime tracing. It matched abuse.ch's own previously-confirmed Cerberus C2 — an independent match against ground truth. A Telegram transport address (149.154.167.99:443) was also observed but is not a distinct C2 and is not listed as an indicator. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• Cerberus - A new banking Trojan from the underworld
  ThreatFabric
• Alien - the story of Cerberus' demise
  ThreatFabric
• ERMAC - another Cerberus reborn
  ThreatFabric
• Cerberus Android Malware Can Bypass 2FA, Unlock Devices Remotely
  BleepingComputer
• The rise of Cerberus: Android banking malware is available for free in underground forums
  Kaspersky
• Cerberus (apk.cerberus)
  Malpedia (Fraunhofer FKIE)

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.