SEKOIA_Trojan_Android_Cerberus

rule SEKOIA_Trojan_Android_Cerberus : FILE
{
	meta:
		description = "Detect samples of the Android banking trojan Cerberus, or its family"
		author = "Sekoia.io"
		id = "3ea398bd-a80c-40f4-ad52-73b528add4ad"
		date = "2022-01-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/trojan_android_cerberus.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "18109733d15c994015646e786a7c6177a1209200fd4c80042db3d48c97c02030"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "assets/neurax.txt"
		$str1 = "assets/Card_UpPotency_UI.json"
		$str2 = "assets/Card_SignetFoster_UI.json"
		$str3 = "assets/Gene_EmpathyTrainer.png"
		$bin0 = "assets/180417.bin"
		$bin1 = "assets/180513.bin"
		$bin2 = "assets/180527.bin"
		$bin3 = "assets/180528.bin"

	condition:
		uint32be( 0 ) == 0x504B0304 and filesize > 1MB and filesize < 4MB and 3 of ( $str* ) and 3 of ( $bin* )
}