# MA-789.062020: MyCERT Advisory - StayAtHome malicious APK campaign

**Date:** 27 Jun 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-789.062020  
**Advisory ID:** MA-789.062020

---

**1.0 Introduction**
MyCERT received a tip-off regarding a malicious android application that is leveraging on COVID-19 pandemic taking advantage of COVID-19 patient tracking and  latest information application for Malaysian user.  As a preventive measure, MyCERT release this advisory to recommend internet user in Malaysia to take necessary steps to secure their systems against unwanted incidents as well from other security threats.
**2.0 Impact**
Observation from this malware sample, we identified that this malware variant could cause severe impact toward the victims such as: 
- Account compromise.
- Continuation of the campaign towards new victims through information stolen from infected device.
- Data exfiltration.
- Illegally use of victim’s premium-charge calls and sending paid SMS.
- Possible lateral movement in the network.
- Steals sensitive information and credential from infected devices.
- Violation on victim’s privacy.
**3.0 Tactic, Techniques and Procedures**
The threat actors is believe to be distributing a Cerberus variant that is using StayAtHome as theme. It is offered as malware-as-a-service(MAaS) for rental in the underground forum. Threat actors could build their own payload, and configure, command and control any devices infected with it. Cerberus malware has the same capabilities as most other Android banking Trojans such as the use of overlay attacks, SMS control and contact list harvesting. The Trojan can also leverage keylogging to broaden the attack scope. Overall, the malware intention is to collect device and user account information of victims for malicious purposes.
Our example malware is a hash tweeted on 2nd June 2020 by the MalwareHunterTeam, @malwrhunterteam as below:
*Figure 1: Malware hash and link from MalwareHunterTeam*
URL: https://defase241.s3.eu-central-1.amazonaws[.]com/StayHomeMalaysia.apk 
The link hosted a malicious APK to lure Malaysian users to install the fake application that is perpetrated to provide COVID-19 patient tracking and latest information on the pandemic.
*Figure 2: Malicious APK installed in Application Drawer*
As shown in Figure 2, a StayAtHome icon will appear in the application drawer once installed. When the victim starts the application, it will request to enable a feature from the Accessibility setting to monitor activities on the device. As shown in Figure 3, after the settings have been allowed by victims, it will automatically lock the setting activity and block any user of attempt to change or disable the feature. It is also capable of disabling Play Protect (Google's preinstalled antivirus solution) to prevent its discovery and deletion. The application then hides its icon, and requesting necessary permission requires more functionality during runtime.
*Figure 3: Accessibility settings requested by malware and other permission requested  by the malicious application*
If all permission has been allowed, the malware will then register itself to its C2 server and sends initial communication including information about infected devices to its C2 server.
*Figure 4: Communication between affected device to C2 server.*
Next, the malware will request for Device Administrator functionality to be enabled. The request dialog message will popped up for a few seconds, and the permission is granted automatically by the malware through auto-click features.
*Figure 5: The malware requesting Device Administrator*
This variant payload specially crafted to phish victim banking details and screen lock patterns. The malware shows its capability of grabbing victims’ financial credentials through its phishing payload. Figure 6 shows the database structure for information that will save to this database.
*Figure 6: Tables in the database from phishing payload in the malware and table structures from one of the database tables*
The code snippet below shows the malware is also capable of capturing screen lock patterns.
*Figure 7: Code snippet of screen lock capture*
Our analysis also found several other malicious APK with similar codes and behavior targeting Malaysian mobile users.
*Figure 8: Other similar malicous apk*
For a more in-depth explanation on the malware, kindly refer to our technical alert provided below:
[MA-788.062020: MyCERT Alert - Malicious Android APK theme Covid-19 targeting Malaysia users](https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=f836c530-44f0-4faa-b1fc-027f9d5e4ec5)
**4.0 Affected Products**
Targeting Android Lollipop until Android 10, API level 21 until 29
**5.0 Indicator of Compromise**
|  |  | --- | --- | --- | --- | URL | Domain | IP Address | Hashes | hxxps://defase241.s3.eu-central-1.amazonaws[.]com/StayHomeMalaysia.apk  hxxps://fewfasdfwerta.s3.eu-central-1.amazonaws[.]com/StayAtHome.apk  hxxps://stayinghomemalaysia.s3.eu-central-1.amazonaw[.]com/StayingHomeMalaysia.apk  hxxps://20gbcampings[.]com/APK/20GBGift.apk  hxxps://fesastatre214s.s3.eu-central-1.amazonaws[.]com/Hadiah.apk | cabel1lan4ightice2.top  fe2rltao23ts.top  gladyobreic24e1s.top  ucuzplastk.tk | 47.252.20.45  148.66.159.235 | b4546bfaa3f339f624a9fe8e64a682e1  8FF52A49B6EFC41C5BD3F77C406297F3  548BAE857891CC7E578031922DEF6C5A  b61c8f5157a38a1b40b4294be3e8cb29  69efe778721dcd66bbd7ed1eaf2ae116 |
**6.0 Recommendations**
Attached below are some recommendations for internet users as preventive measures and mitigation steps against these attacks: 
- Do not click on links to download any application from an unknown source.
- Verify email or text messages that contain links to download the COVID-19 tracing or informational application before installing it.
- Contact relevant authorities such as Cyber999 for any inquiries and assistance needed 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. https://urlhaus.abuse.ch/browse.php?search=amazonaws.com
2. https://twitter.com/malwrhunterteam/status/1267706781914075137?s=09
3. https://twitter.com/malwrhunterteam/status/1267766216766173184
4. https://otx.alienvault.com/pulse/5ed61b6095a46a901650eac8
5. https://research.checkpoint.com/2020/covid-19-goes-mobile-coronavirus-malicious-applications-discovered/
6. https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html
7. https://attack.mitre.org/techniques/T1523/
8. https://www.anomali.com/blog/leashing-cerberus