SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play

MITRE Techniques

• [T1552] Unsecured Credentials – Malware retrieves Base64-encoded and AES-256 encrypted configuration data including C2 URLs from its Info.plist or UserDefaults. (‘It retrieves the Base64-encoded value of the ccc key from the framework’s Info.plist file…The decrypted value is a list of URLs from which the malware fetches additional payloads’)
• [T1071.001] Application Layer Protocol: Web Protocols – Malware sends GET and PUT requests to C2 servers to check authorization and exfiltrate stolen images. (‘The malware sends a GET request to the /api/getImageStatus endpoint…Data transmission is performed…by making a PUT request to the /api/putImages endpoint’)
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder / Objective-C +load Selector – The malicious AFNetworking framework exploits Objective-C’s load selector (+[AFImageDownloader load]) to run payload at app load time. (‘…they took advantage of a feature in Objective-C that allows classes to define a special load selector, which is automatically called when the app is loading’)
• [T1189] Drive-by Compromise – iOS users are tricked into installing provisioning profiles to run malicious apps through fake App Store mimics. (‘visiting the website on an iPhone triggers…prompts them to download an app…using Enterprise profiles’)
• [T1005] Data from Local System – Spyware accesses user photo galleries on iOS and Android to collect images. (‘The malware requests access to the user’s photo gallery and registers a callback function to monitor any changes within the gallery’)
• [T1110] Brute Force – The malware tries multiple C2 servers by measuring response times and selects the fastest for communication. (‘Among the decrypted C2 addresses… It does this by sending a request to each server sequentially…The shortest time then determines which C2 server is used’)
• [T1059.001] Command and Scripting Interpreter: PowerShell – Usage of Frida script for dynamic analysis of malicious libraries was noted, showing the technique used to analyze malware behavior. (‘Using Frida, we can execute any piece of code as a function…’)