CORRUPT KITTEN Exposed

Iran Cyber News Agency was previously able to reveal the discovery of new malware targeting Iranian citizens. In the interests of protecting innocent citizens from further attacks we can reveal more of the technical specifications of the malware and how it is used. The information was contributed by our source who for his security does not want his name to be published. ICNA Admin.

This malware is a beaconing, taskable implant. It uses Hyper Text Transfer Protocol (HTTP) based communication. The C2 server hosts what appears to be a fake website called “Pine State Flowers”. The domian name does not relate to the content of the site and the version we are looking at is version number 5. We also know from the database on the server hosting the domain that version 1 to 4 were aso used.

The analysis was a DEX (Dalvik Executable, a component file of an android application) file attached to an unknown Android APK (an android application). The MD5 hash of the DEX file is 0ab74c36977632a8dc517fb0c8c95189.

The implant which manages a SQLite database which it uses to hold all of the implant state including queued commands and information about the results of those commands. This database acts as a nexus for inter-communication between the different asynchronous modules of the implant.

Commands are requested by a beacon module then placed into the commands table. A dispatcher removes rows from the command table and examining the ‘name’ field, creates a new instance of the relevant task by name. Tasks are runnable java objects and exist in their own thread, upon completion, the task object writes its results to disk with an accompanying entry into the data table. Finally an exfiltration module reads the data table and uploads results to infrastructure.

Files ready for exfiltration are stored in either of the two directories device:

• /storage/emulated/0/.data_gsc98647a3/
• /storage/emulated/0/Andorid/.data_gsc98647a3/

The directory name is hardcoded and is not a runtime-generated or random string. In many cases the data is stored using an AES-128-CBC hardcoded key and IV.

Corrupt Kitten supports a full rnage of spying and device management capability. Commands and their resutls are stroed in the above SQLite tables at various stages of their dispatch. The specific task is indicated by the name field in all of the tables, with a value taken from the table below. The ‘exfiltration indicator’ column is the first 16 characters of the SHA-1 hash of the command name. This value is included in the data exfiltration HTTP requests to indicate the command for which the data corresponds.

Communications are sent to a hardcoded infrastructure URL http://hardship-management.com:4373. The communications are protected by a process of comrpession via gzip, then AES-128-cbc encryption and then base64 encoded. A hardcoded AES key of f3544c085656c997 and IV of 4fcff6864c594343 are used. These values are ASCII encoded.

Communications are in the form of HTTP POST requests with varying parameters and values.

Commands are requested by the C2 server, and sent back in cleartext json under base64 encoding:

• {“commands”:[], “commands_data”:[],”settings”:[]}

Indicators of compromise

The following indicators of compromise can be used to detect Corrupt Kitten activity: