Research: Lookout: MouaBad.P : Pocket Dialing For Profit
Sample credit: Tim Strazzere
File: com.android.service.apk_mouabad_p_infected
Size: 38505
MD5: 68DF97CD5FB2A54B135B5A5071AE11CF
Download. Email me if you need the password
Wednesday, December 11, 2013
MouaBad.P - Android dialer SMS trojan
Research: Lookout: MouaBad.P : Pocket Dialing For Profit
Sample credit: Tim Strazzere
File: com.android.service.apk_mouabad_p_infected
Size: 38505
MD5: 68DF97CD5FB2A54B135B5A5071AE11CF
Download. Email me if you need the password
Sunday, November 24, 2013
ZertSecurity - Android Bank infostealer
Zertsecurity 1CF41BDC0FDD409774EB755031A6F49D
Research
http://www.evild3ad.com/3008/analysis-of-android-zitmo-urlzone/
http://www.android-decompiler.com/blog/2013/04/22/sms-spy-zertsec/
https://blog.lookout.com/blog/2013/05/06/zertsecurity/\
http://www.symantec.com/security_response/writeup.jsp?docid=2013-050820-4100-99
The Trojan prompts users for bank account and PIN code information and steals it
FakeNotify.B (2011) - Premium SMS Trojan
f57e2769518f081721ffca586e797b2a
Research :
Trojan:Android/FakeNotify Gets Updated http://www.f-secure.com/weblog/archives/00002291.html?tduid=f57e2769518f081721ffca586e797b2a
Download. Email me if you need the password
Research :
Trojan:Android/FakeNotify Gets Updated http://www.f-secure.com/weblog/archives/00002291.html?tduid=f57e2769518f081721ffca586e797b2a
Roidsec / Sinpon - Android Infostealer
Roidsec D4A557EC086E52C443BDE1B8ACE51739
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-052022-1227-99&tabid=2
Functionality
The Trojan collects the following information from the compromised computer:
Sends SMS messages
Forces the phone to stay on
Collect call log
Collect contacts
Collect installed apps
Collect GPS location
Collect memory size available on phone memory
Collect SD memory size available
List all files on SD with timestamps
Collect incoming SMS messages
Collect outgoing SMS messages
List of apps currently running
Collect total amount of RAM
Status of WiFi being on or off
List all files on phone memory with timestamps
Deletes files on SD card
Download. Email me if you need the passwordSimhosy / Waps - Android infostealer
simhosy 6B2D0948A462431D93A2035A82AF6CB5
simhosy 533453B7F3A7F55816B2EDCD5326DD2D
simhosy D2151D102F8DCBCD03DA4B9F3070F4D3
The Trojan steals SMS messages and contacts from the compromised device
Download. Email me if you need the passwordPhosty / Phospy - Android infostealer
Phospy 5F23671F67F0FBFC2529919DB56485A0
Phospy EED211032FF576F7FD590C22F142B877
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-060706-4803-99&tabid=2
The Trojan steals all .jpg and .mp4 files it finds on the device
Download. Email me if you need the password
Phospy EED211032FF576F7FD590C22F142B877
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-060706-4803-99&tabid=2
The Trojan steals all .jpg and .mp4 files it finds on the device
Download. Email me if you need the password
Fakedaum / vmvol - Android Infostealer
Fakedaum 0B6CDC9B9F778E0D8171DD279C5F690B
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-061813-3630-99&tabid=2
The Trojan then gathers the following information from the compromised device:
SMS messages
Phone number
IMEI
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-061813-3630-99&tabid=2
The Trojan then gathers the following information from the compromised device:
SMS messages
Phone number
IMEI
Usbcleaver - Android infostealer (from Windows PC)
Usbcleaver 283D16309A5A35A13F8FA4C5E1AE01B1
Usbcleaver C22C068EAEE7AD7FD4FD015CD50045DB
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-062010-1818-99
Functionality
When the device is connected to a Windows computer that does not have autorun disabled, the Trojan then gathers information from the computer, including:
Default gateway
DNS
Google Chrome password
Host name
IP address
Microsoft Internet Explorer password
Mozilla Firefox password
Physical address
Subnet mask
WiFi password
It then stores the above information in the following location, which a remote attacker can retrieve at a later stage:
/sdcard/usbcleaver/logs/
Download. Email me if you need the password.
Usbcleaver C22C068EAEE7AD7FD4FD015CD50045DB
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-062010-1818-99
Functionality
When the device is connected to a Windows computer that does not have autorun disabled, the Trojan then gathers information from the computer, including:
Default gateway
DNS
Google Chrome password
Host name
IP address
Microsoft Internet Explorer password
Mozilla Firefox password
Physical address
Subnet mask
WiFi password
It then stores the above information in the following location, which a remote attacker can retrieve at a later stage:
/sdcard/usbcleaver/logs/
Fake Taobao - Android infostealer
MD5: 45DAE1EE4CA1980C140CB5C9DA2A7ED5
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-062518-4057-99
The Trojan sends the following information to a specific phone number:
Taobao user name
Taobao password
Zhifubao user name
Zhifubao password
The Trojan requires another .apk file to be downloaded so it can forward SMS messages to the specific phone number.
Download. Email me if you need the password.
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-062518-4057-99
The Trojan sends the following information to a specific phone number:
Taobao user name
Taobao password
Zhifubao user name
Zhifubao password
The Trojan requires another .apk file to be downloaded so it can forward SMS messages to the specific phone number.
Skullkey - Android Infostealer
skullkey 2DC07DCA36487339F3935ACE890E42E0
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-072322-5422-99&tabid=2
Package names: com.hk515.doctor, com.hk515.activity
Malicious code is inserted in the package in the following locations:
com.google.safemain
com.google.service
Permissions
When the Trojan is being installed, it requests permissions to perform the following additional actions:
Clear the caches of all installed applications on the device.
Read user's contacts data.
Monitor incoming SMS messages.
Read SMS messages on the device.
Send SMS messages.
Start once the device has finished booting.
Change the background wallpaper.
Monitor incoming WAP push messages.
Functionality
The Trojan hides using the Android 'Master Key' vulnerability to keep the legitimate app signature valid.
The Trojan allows attackers to perform the following actions:
Open a back door
Steal sensitive data (such as IMEI and phone number) and sends it to apkshopping.com
Send premium SMS messages
Disable certain security apps by using any available root commands
Fakemart - Android infostealer
Fakemart D002F0581A862373AA6C6C0070EC3156
Fakemart 27CFDF25ECAE75342A21230D19151939
Fakemart 6A0E9CE340164AF6F37A946DF650B458
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-081217-1428-99&tabid=2
The Trojan may perform the following actions:
Clear the XMBPSP.xml contents in shared preference
Configure the XMBPSP.xml file to send SMS to 81211 or 81308
Set the device to silent mode
Delete SMS received from 81211
Open network connections
Block incoming SMS, encode the body of the message, and post them to the above URLs
Send SMS to 81211 or 81308 if the first ten incoming SMS contain the strings "BD MULTIMEDIA" or "code"
Download. Email me if you need the password.
Fakemart 27CFDF25ECAE75342A21230D19151939
Fakemart 6A0E9CE340164AF6F37A946DF650B458
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-081217-1428-99&tabid=2
The Trojan may perform the following actions:
Clear the XMBPSP.xml contents in shared preference
Configure the XMBPSP.xml file to send SMS to 81211 or 81308
Set the device to silent mode
Delete SMS received from 81211
Open network connections
Block incoming SMS, encode the body of the message, and post them to the above URLs
Send SMS to 81211 or 81308 if the first ten incoming SMS contain the strings "BD MULTIMEDIA" or "code"
Fakeupdate / Apkquq - Android
Size: 3056158
MD5: 9258022182579F07AAAC0C74790E56D0
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-081914-5637-99
Download. Email me if you need the password.
MD5: 9258022182579F07AAAC0C74790E56D0
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-081914-5637-99
Download. Email me if you need the password.
Jollyserv - Android Infostealer
Size: 438324
MD5: 2BE48FB3B8D89F64A18C459067AF3695
Research https://www.virustotal.com/en/file/31cb4d111c754077fcffaf44b5cdb220d2c12ab3e5d297e829072a79bb4cb44c/analysis/
The Trojan may then perform the following actions on the compromised device:
Send SMS messages to a premium number
Send SMS messages to all contacts
Intercept SMS messages
Next, the Trojan gathers the following information from the compromised device:
Phone number
List of running applications
Stored messages
System logs
Download. Email me if you need the password
MD5: 2BE48FB3B8D89F64A18C459067AF3695
The Trojan may then perform the following actions on the compromised device:
Send SMS messages to a premium number
Send SMS messages to all contacts
Intercept SMS messages
Next, the Trojan gathers the following information from the compromised device:
Phone number
List of running applications
Stored messages
System logs
Download. Email me if you need the password
Repane - Android Infostealer
Repane 0D924A1D6754C5B326C1DA7D474EC7A5
Repane ADD031D774F67B030CE86718AD95040B
Research http://www.symantec.com/security_response/writeup.jsp?docid=2013-090411-5052-99
Trojan may gather the following information from the compromised device:
Phone number
Integrated circuit card identifier (ICCID)
Network operator
Device identification number
Download. Email me if you need the password.
Godwon - Android Infostealer
Godwon C11FC7207BFBDB91E35B6C285FE0934F
Godwon 79309179DB63D2B505398ABCB4DD1AE0
Godwon 1238F2387193330BC79E7A03E92C2038
Godwon 2C373AA90942FEDC21BB0B2D35E8E340
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091017-1833-99
Download. Email me if you need the password
Godwon 79309179DB63D2B505398ABCB4DD1AE0
Godwon 1238F2387193330BC79E7A03E92C2038
Godwon 2C373AA90942FEDC21BB0B2D35E8E340
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091017-1833-99
Download. Email me if you need the password
Fakedefender.B - Android Fake Antivirus
Size: 2081371
MD5: E790C4295B8ADB23D090BAE5D6EB786A
Android.Fakedefender.B is a Trojan horse for Android devices that displays fake security alerts in an attempt to convince the user to purchase an app in order to remove non-existent malware or security risks from the device.
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091013-3953-99
Fakeplay - Android Infostealer
Android
CF136807D017ADF772C0A35D2919D951 Fakeplay
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-100917-3825-99&tabid=2
Download. Email me if you need the password
CF136807D017ADF772C0A35D2919D951 Fakeplay
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-100917-3825-99&tabid=2
Beita - Android Infostealer
Android.Beita 10953B741D166D9E22937FE00FBF1038
com.beita.contact
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-110111-1829-99
It gathers the following information from the user's list of contacts:
- Name
- Phone number
- Address
Download. Email me if you need the password
Backflash / Crosate - Android infostealer
File: Backflash_A3EB6B30E23146D9D44103ADDC71A41B
Size: 784255
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091714-0427-99
Payload: Opens a back door.
Releases Confidential Info: Steals information from the compromised device.
Download. Email me if you need the password
Size: 784255
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-091714-0427-99
Payload: Opens a back door.
Releases Confidential Info: Steals information from the compromised device.
Download. Email me if you need the password
Fakebank.A and Fakebank.B - Android Infostealer trojan
Functionality
When executed, the Trojan displays a form asking the user to enter in banking details.
Android.Fakebank (A and B) is a Trojan horse that steals information from the compromised device.
FakebankB_8BF10991F292EC7D165086506E8F0EDA
FakebankB_98EEA1D94A479E022E46D69B0FBE2453
FakebankB_A0721023EC39948251818306A15D3268
Fakebanker_37DFF309CC911A1DC16CCE4E51F9827B
Fakebanker_67E7BB573EAA1F25772809A471CDA327
Scipiex - Android Infostealer
Size: 329137
MD5: 6BD95C5BB0A99B29FF83D72DC578947B
Android.Scipiex is a Trojan horse for Android devices that steals information from the compromised device.
Android package file
The Trojan may arrive as a package with the following characteristics:
Package name: com.yxx.jiejie
APK: p2.apk
Name: Love Chat (translated from Korean)
Uten - Android SMS Trojan
Size: 93942
MD5: DE49239E19D97043DCE57D7C4E5CCA51
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-092316-4752-99&tabid=2
Download. Email me if you need the password
MD5: DE49239E19D97043DCE57D7C4E5CCA51
Research: http://www.symantec.com/security_response/writeup.jsp?docid=2013-092316-4752-99&tabid=2
Tuesday, September 17, 2013
Android FakeAV - Labelreader.apk
Research: Android Mobile: Following In the Windows Footsteps
fakeAV_1CA532F171A0B765A46AF995EBAAB1D2_LabelReader.apk 1ca532f171a0b765a46af995ebaab1d2
fakeAV_1E178E501B41659FFACE85153615DEA7_LabelReader.apk 1e178e501b41659fface85153615dea7
fakeAV_6F237D25472D9D09FC44ECE7DC9CED92_LabelReader.apk 6f237d25472d9d09fc44ece7dc9ced92
fakeAV_36B177910C99872B33E90DEA71B16617_LabelReader.apk 36b177910c99872b33e90dea71b16617
fakeAV_75B8F9DBB1CD79B7FC074F7F499150CF_LabelReader.apk 75b8f9dbb1cd79b7fc074f7f499150cf
fakeAV_77BB7F86FB0AC66C97B1AB3573ADFFC1_LabelReader.apk 77bb7f86fb0ac66c97b1ab3573adffc1
fakeAV_148B76C664F2854E2947AF01160FFA99_LabelReader.apk 148b76c664f2854e2947af01160ffa99
fakeAV_934527F8EBB5C1088009CC9329DC3DE6_LabelReader.apk 934527f8ebb5c1088009cc9329dc3de6
fakeAV_ED1E0689F93B0C57E403489BB5338F59_LabelReader.apk ed1e0689f93b0c57e403489bb5338f59
Thursday, September 12, 2013
Android Malapp
File: com.android.secrettalk-1.apkSize: 425809
MD5: 301F53CD5387CA1FE0DBBE47E40DFD8F
File: com.app.lotte.auth-1.apk
Size: 1933672
MD5: 73C2E204A9C11B7E03015954B86B7EA1
Download. Email me if you need the password
Android Lien.A / SMSAgent.C - SMTP malware
File: 20130802_031615.apk
Size: 322915
MD5: C9B7BE2C1518933950B0284FC254C485
Research: F-Secure: Android Malware goes SMTP
Saturday, July 13, 2013
TRracer - commercial spyware / PUA samples for Android, Blackberry, SymbOS, iOS
Riskware/Killmob!Android
Riskware/Killmob!Blackberry
Riskware/Killmob!SymbOS
Riskware/Killmob!iOS
Commercial spyware.
Functionality inlcudes (judging by the files - see more
http://killermobile.com/manuals/TRa.pdf
Schedule Days
Schedule Time
Data Setting
Report Call Logs
Report Contacts
Report SMS
Report Gmail
Report Web Browser
Report New Photos
Report New Videos
Call Record
Call Record Strategy
Record Format
Report Whatsapp Chats
Report Viber Chats
Report Skype Chats
Report Facebook Chats
Report Facebook Photos
Spy Call Number(s)
Do not record Spy Calls
Report GPS location
Recover via GMail
Enable GMail recovery
Download all files (Email me if you need the password)
Files included
File: TRa7.0.sis
MD5: d55c0e339a2cbb91132f53c5ecaf4fd5
Size: 266200
File: Tracer-1.cod
MD5: df01e4ea2433dc08bce21b7b44a604eb
Size: 43240
File: TRacer.apk.1
MD5: 1c37f184a707d2c7c6d79cabeda2df69
Size: 7938460
File: com.timecompiler.Tracer_0.0.1-958_iphoneos-arm.deb
MD5: fbb4a02d9921cb303d70c147bd8e270c
Size: 2669126
Schedule Time
Data Setting
Report Call Logs
Report Contacts
Report SMS
Report Gmail
Report Web Browser
Report New Photos
Report New Videos
Call Record
Call Record Strategy
Record Format
Report Whatsapp Chats
Report Viber Chats
Report Skype Chats
Report Facebook Chats
Report Facebook Photos
Spy Call Number(s)
Do not record Spy Calls
Report GPS location
Recover via GMail
Enable GMail recovery
Download all files (Email me if you need the password)Files included
File: TRa7.0.sis
MD5: d55c0e339a2cbb91132f53c5ecaf4fd5
Size: 266200
File: Tracer-1.cod
MD5: df01e4ea2433dc08bce21b7b44a604eb
Size: 43240
File: TRacer.apk.1
MD5: 1c37f184a707d2c7c6d79cabeda2df69
Size: 7938460
File: com.timecompiler.Tracer_0.0.1-958_iphoneos-arm.deb
MD5: fbb4a02d9921cb303d70c147bd8e270c
Size: 2669126
Thursday, June 6, 2013
Backdoor.AndroidOS.Obad.a
Update Sept 13, 2013
Sandbox results from Andrototal:
http://andrototal.org/sample-
http://andrototal.org/sample-
Research:
Kaspersky: The most sophisticated Android Trojan
Droidnews: Самый сложный вредонос под Android
Sample credit: Tim Strazzere (Lookout Security)
Size: 84306
MD5: E1064BFD836E4C895B569B2DE4700284
Size: 85079
MD5: F7BE25E4F19A3A82D2E206DE8AC979C8
Download. Email me if you need the password
The following analysis was shared by Gunther
If you simply use dex2jar+JD-GUI, you will realised that most of the methods can't be decompiled.
Furthermore, i've realised that the one which it managed to decompiled looked wrong too.
I've attached my manual approach as well
Basically for a start, i would recommend you to use apktool first.
apktool.bat d <filename>
You should see something like this after running the above command.
C:\Users\Gunther\Desktop\apktool>apktool.bat d F7BE25E4F19A3A82D2E206DE8AC979C8
I: Baksmaling...
I: Loading resource table...
I: Loaded.
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: C:\Users\Jacob\apktool\framework\1.apk
I: Loaded.
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Done.
I: Copying assets and libs...
C:\Users\Gunther\Desktop\apktool>
Now let’s take a look at the AndroidManifest.xml file, you should see the the permissions requested by the APK file.
It's a huge list so i won't paste it here.
From the AndroidManifest.xml, we also know the following
1.) This malware have several "service" entries.
Furthermore, if we look up http://developer.android.com/guide/topics/manifest/intent-filter-element.html we can see that it indicates to have a high priority.
2.) There is an Activity entry and under the “intent” tag of this Activity entry. It indicates to start as the main entry point according to http://developer.android.com/reference/android/content/Intent.html#ACTION_MAIN
According to the official diagram from Android, we should be looking at “OnCreate” function first.
3.) Earlier on, i've written that there are several "Service" being started by this app. According to http://developer.android.com/reference/android/app/Service.html We should be looking at “OnCreate” or “StartService” in that class file.
This “Service” is running in the background even when the user is not directly interacting with the application.
Analysis of Dalvik Code:
Let’s take a look at the onCreate function first. To have a better understanding of Dalvik byte code, it’s probably better to have either of the following 2 links:
http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html
http://source.android.com/tech/dalvik/dalvik-bytecode.html
Now before we go to "OnCreate", earlier on i've mentioned that Dex2Jar screwed it up right. Let's look at "cOIcOOo" in this smali file, "OclIIOlC"
Now look at the original smali code and this one with comments.
.method private static cOIcOOo(III)Ljava/lang/String;
// private static String cOIcOOo(Int paramInt1, Int paramInt2, Int paramInt3){
.locals 6
sget-object byteArray1, Lcom/android/system/admin/OclIIOlC;->cOIcOOo:[B
// byte[] byteArray1 = OclIIOlC.cOIcOOo;
add-int/lit8 p0, p0, 0x60
// paramInt1 = paramInt1+0x60
add-int/lit8 paramInt3, paramInt3, 0x21
// paramInt3 = paramInt3+0x21;
const/4 k, 0x0
// int k = 0;
new-instance v0, Ljava/lang/String;
// String v0;
new-array byteArray2, paramInt3, [B
// byte[] byteArray2 = new byte[paramInt3];
if-nez byteArray1, :cond_0
// if( byteArray1==null ){
move v2, paramInt3
// v2 = paramInt3;
// }
move v3, paramInt2
// v3 = paramInt2;
:goto_0
add-int/lit8 paramInt2, paramInt2, 0x1
// paramInt2 += 1;
// or paramInt2++;
add-int/2addr v2, v3
// v2 += v3;
add-int/lit8 paramInt1, v2, -0x2
// paramInt1 = v2 + (-0x2);
:cond_0
int-to-byte v2, paramInt1
aput-byte v2, byteArray2, k
// Puts the byte value in v2 into an element of a byte array. The element is indexed by k, the array object is referenced by byteArray2.
// byteArray2[k] = v2;
add-int/lit8 k, k, 0x1
// k +=0x1;
// or k++;
if-lt k, paramInt3, :cond_1
// if( k>=paramInt3 ){
const/4 v2, 0x0
// v2 = 0x0;
invoke-direct {v0, byteArray2, v2}, Ljava/lang/String;-><init>([BI)V
return-object v0
// return new String(byteArray2, v2);
:cond_1
move v2, paramInt1
// v2 = paramInt1;
aget-byte v3, byteArray1, paramInt2
// Gets a byte value of a byte array into v3. The array is referenced by byteArray1 and is indexed by paramInt2.
// v3 = byteArray1[paramInt2];
goto :goto_0
.end method
}
Now compare it with "HelloWorld", which I've attached here. This should be the way to finally reverse it...i think.
Ok, i've also mentioned before on why AVs and some of the tools don't work.
Most of the better Android malware nowadays uses Reflection API.
Reflection can allow a program to create a "function pointer" and invoke the target function by using it. You can see it's common usage in ExploitKits or those Java exploits.
You will see it when you start reversing "OnCreate" function.
Sandbox results from Andrototal:
http://andrototal.org/sample-
http://andrototal.org/sample-
Research:
Kaspersky: The most sophisticated Android Trojan
Droidnews: Самый сложный вредонос под Android
Sample credit: Tim Strazzere (Lookout Security)
Size: 84306
MD5: E1064BFD836E4C895B569B2DE4700284
Size: 85079
MD5: F7BE25E4F19A3A82D2E206DE8AC979C8
Download. Email me if you need the password
The following analysis was shared by Gunther
If you simply use dex2jar+JD-GUI, you will realised that most of the methods can't be decompiled.
Furthermore, i've realised that the one which it managed to decompiled looked wrong too.
I've attached my manual approach as well
Basically for a start, i would recommend you to use apktool first.
apktool.bat d <filename>
You should see something like this after running the above command.
C:\Users\Gunther\Desktop\apktool>apktool.bat d F7BE25E4F19A3A82D2E206DE8AC979C8
I: Baksmaling...
I: Loading resource table...
I: Loaded.
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: C:\Users\Jacob\apktool\framework\1.apk
I: Loaded.
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Done.
I: Copying assets and libs...
C:\Users\Gunther\Desktop\apktool>
Now let’s take a look at the AndroidManifest.xml file, you should see the the permissions requested by the APK file.
It's a huge list so i won't paste it here.
From the AndroidManifest.xml, we also know the following
1.) This malware have several "service" entries.
Furthermore, if we look up http://developer.android.com/guide/topics/manifest/intent-filter-element.html we can see that it indicates to have a high priority.
2.) There is an Activity entry and under the “intent” tag of this Activity entry. It indicates to start as the main entry point according to http://developer.android.com/reference/android/content/Intent.html#ACTION_MAIN
According to the official diagram from Android, we should be looking at “OnCreate” function first.
3.) Earlier on, i've written that there are several "Service" being started by this app. According to http://developer.android.com/reference/android/app/Service.html We should be looking at “OnCreate” or “StartService” in that class file.
This “Service” is running in the background even when the user is not directly interacting with the application.
Analysis of Dalvik Code:
Let’s take a look at the onCreate function first. To have a better understanding of Dalvik byte code, it’s probably better to have either of the following 2 links:
http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html
http://source.android.com/tech/dalvik/dalvik-bytecode.html
Now before we go to "OnCreate", earlier on i've mentioned that Dex2Jar screwed it up right. Let's look at "cOIcOOo" in this smali file, "OclIIOlC"
Now look at the original smali code and this one with comments.
.method private static cOIcOOo(III)Ljava/lang/String;
// private static String cOIcOOo(Int paramInt1, Int paramInt2, Int paramInt3){
.locals 6
sget-object byteArray1, Lcom/android/system/admin/OclIIOlC;->cOIcOOo:[B
// byte[] byteArray1 = OclIIOlC.cOIcOOo;
add-int/lit8 p0, p0, 0x60
// paramInt1 = paramInt1+0x60
add-int/lit8 paramInt3, paramInt3, 0x21
// paramInt3 = paramInt3+0x21;
const/4 k, 0x0
// int k = 0;
new-instance v0, Ljava/lang/String;
// String v0;
new-array byteArray2, paramInt3, [B
// byte[] byteArray2 = new byte[paramInt3];
if-nez byteArray1, :cond_0
// if( byteArray1==null ){
move v2, paramInt3
// v2 = paramInt3;
// }
move v3, paramInt2
// v3 = paramInt2;
:goto_0
add-int/lit8 paramInt2, paramInt2, 0x1
// paramInt2 += 1;
// or paramInt2++;
add-int/2addr v2, v3
// v2 += v3;
add-int/lit8 paramInt1, v2, -0x2
// paramInt1 = v2 + (-0x2);
:cond_0
int-to-byte v2, paramInt1
aput-byte v2, byteArray2, k
// Puts the byte value in v2 into an element of a byte array. The element is indexed by k, the array object is referenced by byteArray2.
// byteArray2[k] = v2;
add-int/lit8 k, k, 0x1
// k +=0x1;
// or k++;
if-lt k, paramInt3, :cond_1
// if( k>=paramInt3 ){
const/4 v2, 0x0
// v2 = 0x0;
invoke-direct {v0, byteArray2, v2}, Ljava/lang/String;-><init>([BI)V
return-object v0
// return new String(byteArray2, v2);
:cond_1
move v2, paramInt1
// v2 = paramInt1;
aget-byte v3, byteArray1, paramInt2
// Gets a byte value of a byte array into v3. The array is referenced by byteArray1 and is indexed by paramInt2.
// v3 = byteArray1[paramInt2];
goto :goto_0
.end method
}
Now compare it with "HelloWorld", which I've attached here. This should be the way to finally reverse it...i think.
Ok, i've also mentioned before on why AVs and some of the tools don't work.
Most of the better Android malware nowadays uses Reflection API.
Reflection can allow a program to create a "function pointer" and invoke the target function by using it. You can see it's common usage in ExploitKits or those Java exploits.
You will see it when you start reversing "OnCreate" function.
Wednesday, May 29, 2013
Android Fakemart - SMS-Trojan
File: Fakemart.apk
Size: 247778
MD5: D002F0581A862373AA6C6C0070EC3156
Research:
French Android Users Hit again by SMS Trojan - Webroot
Android/Fakemart's end: Author has been identified -Fortigard
Monday, May 13, 2013
Android Stels
Hello all, sorry for the long outage - been busy :) Here are are 3 posts for Stels, Perkele, and Korean SMSspy (see 2 posts after this one)
Android Stels
File: flashplayer.android.update.apk
Size: 164210
MD5: B226A66A2796E922302B96AE81540D5C
Research: Stels Android Trojan Malware Analysis - Secure Works Dell
Sample credit: Tim Strazzere Lookout Security
Download (Email me if you need the password)
Android Perkele / Fake Site
com-fake site source
Please see the list of included files below
News: Mobile Malcoders Pay to (Google) Play - Brian Krebs
SMS malware bot for sale, created to look like a security certificate with logos of your company
1 app - $1000. Full kit -$15,000
Download. (Email me if you need the password scheme)
Android SMSSpy / SMSSender / Nopoc.A
Sample credit: Jihong ParkSize: 253578
MD5: 74E09C5F57D5A040C86A86CDAD7F04FA
Download: (Email me if you need the pass scheme for the newer samples)
Friday, April 19, 2013
SMSSilense aka Fake Vertu
File: vertu.jp.apkSize: 1689220
MD5: 2E88C747D1B96B6ED19D3B66F00C4D98
File: vertu.kr.apk
Size: 581473
MD5: FD6437199664E097870723F31F81222B
Sample credit: Sanjay Gupta
A new threat has surfaced targeting users in Korea and Japan, but this attack, unlike others making the news, is not one motivated by political or ideological dogma. Instead, this one is based purely on old-fashioned greed. Vertu phone owners or those looking for a localized Vertu theme in Korean or Japanese for an Android phone had better think twice before downloading something. McAfee Mobile Research has identified a new variant of Android/Smsilence distributed under the guise of a Vertu upgrade/theme that is targeting Japanese and Korean users.
BadNews - Android adware/malware network samples
File: live.photo.savanna.apk
Size: 3354613
MD5: 98CFA989D78EB85B86C497AE5CE8CA19
sample credit: Tim Wyatt -Lookout
File: ru.blogspot.playsib.savageknife.apk
Size: 4124257
MD5: 5B08C96794AD5F95F9B42989F5E767B5
sample credit: Sanjay Gupta
Research: The Bearer of BadNews
Lookout has discovered BadNews, a new malware family, in 32 apps across four different developer accounts in Google Play. According to Google Play statistics, the combined affected applications have been downloaded between 2,000,000 – 9,000,000 times.
Saturday, April 6, 2013
Chuli.A - Targeted attack Android Trojan
Research: Kaspersky. Android Trojan Found in Targeted Attack
Backdoor:AndroidOS/Chuli.A
Sample credit: Arvind Kumar
File: c4c4077e9449147d754afd972e247efc
Size: 333583
MD5: C4C4077E9449147D754AFD972E247EFC
File: 0b8806b38b52bebfe39ff585639e2ea2
Size: 334326
MD5: 0B8806B38B52BEBFE39FF585639E2EA2
Download (email me if you need the password)
Monday, March 18, 2013
Android.Uracto - fraud, SMS spam
Research: Symantec. Android.Uracto Used to Trick Mothers, Anime Fans, Gamers, and More
Sample credit: Sanjay Gupta
D09A1FF8A96A6633B3B285F530E2D430 NewsAndroidnocode.apk
4C937667CB23E857D42B664334E1142A NewsAndroidcode03.apk
BA73E96CAA95999321C1CDD766BDF58B NewsAndroidcode02.apk
CF45E1288B47D97326ED279F2EE41E4D NewsAndroidcode01.apk
Friday, March 8, 2013
Android - FakeJobOffer
File: com.saavn.android.apk
Size: 973303
MD5: 9E8FA23DFC817BDCAD42B2F6ADA6E658
Sample credit: Jimmy Shah
Research: Android Malware Goes Bollywood - McAfee
Tuesday, February 26, 2013
SMS trojan - targeting Korean Android devices
File: sb.apk
Size: 23727
MD5: B9CD27AAD217B412B61448AC6976C807
Research: McAfee SMS Trojan Targets South Korean Android Devices
Sample credit: Jimmy Shah
Saturday, February 16, 2013
Android Tetus - Infostealer
File: com.stephbriggs5.batteryimprove-2.apk
Size: 293777
MD5: 6408DF6ABA4C7F1803C2AAC8F17C4CA3
File: 85CE55DC130F214B0567987EDFF77DC0Size: 274999
MD5: 85CE55DC130F214B0567987EDFF77DC0
File: com.droidmojo.awesomejokes.apkSize: 268360
MD5: 01772AEFE0230C3669E21D79FC920D2E
File: 65C75AF5DE2628BD6215BB99DD76D3ACMD5: 65c75af5de2628bd6215bb99dd76d3ac
Size: 277644
Research: Symantec. Android Tetus
When the Trojan is executed, it registers an SMS observer to record SMS messages and send them to the following command-and-control (C&C) server:
[http://]android.tetulus.com
The Trojan may delete some SMS messages from the device.
It may also register an SMS receiver to send SMS messages without the user's consent.
The Trojan may send a list of all installed apps on the device to the following remote location:
[http://]fast.app-engines.com
Subscribe to:
Posts (Atom)