Backdoor.AndroidOS.Obad.a

Update Sept 13, 2013 
Sandbox results from Andrototal:
http://andrototal.org/sample-analysis/hash/E1064BFD836E4C895B569B2DE4700284
http://andrototal.org/sample-analysis/hash/F7BE25E4F19A3A82D2E206DE8AC979C8


Research:
Kaspersky: The most sophisticated Android Trojan
Droidnews: Самый сложный вредонос под Android 

Sample credit: Tim Strazzere (Lookout Security)

Size: 84306
MD5:  E1064BFD836E4C895B569B2DE4700284

Size: 85079
MD5:  F7BE25E4F19A3A82D2E206DE8AC979C8

Download. Email me if you need the password


The following analysis was shared by Gunther

If you simply use dex2jar+JD-GUI, you will realised that most of the methods can't be decompiled.
Furthermore, i've realised that the one which it managed to decompiled looked wrong too.
I've attached my manual approach as well

Basically for a start, i would recommend you to use apktool first.
apktool.bat d <filename>

You should see something like this after running the above command.

    C:\Users\Gunther\Desktop\apktool>apktool.bat d F7BE25E4F19A3A82D2E206DE8AC979C8
    I: Baksmaling...
    I: Loading resource table...
    I: Loaded.
    I: Decoding AndroidManifest.xml with resources...
    I: Loading resource table from file: C:\Users\Jacob\apktool\framework\1.apk
    I: Loaded.
    I: Regular manifest package...
    I: Decoding file-resources...
    I: Decoding values */* XMLs...
    I: Done.
    I: Copying assets and libs...
    C:\Users\Gunther\Desktop\apktool>

Now let’s take a look at the AndroidManifest.xml file, you should see the the permissions requested by the APK file.
It's a huge list so i won't paste it here.

From the AndroidManifest.xml, we also know the following
1.) This malware have several "service" entries.
Furthermore, if we look up http://developer.android.com/guide/topics/manifest/intent-filter-element.html we can see that it indicates to have a high priority.
2.) There is an Activity entry and under the “intent” tag of this Activity entry. It indicates to start as the main entry point according to http://developer.android.com/reference/android/content/Intent.html#ACTION_MAIN

According to the official diagram from Android, we should be looking at “OnCreate” function first.

3.) Earlier on, i've written that there are several "Service" being started by this app. According to http://developer.android.com/reference/android/app/Service.html We should be looking at “OnCreate” or “StartService” in that class file.
This “Service” is running in the background even when the user is not directly interacting with the application.

Analysis of Dalvik Code:
Let’s take a look at the onCreate function first. To have a better understanding of Dalvik byte code, it’s probably better to have either of the following 2 links:
http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html
http://source.android.com/tech/dalvik/dalvik-bytecode.html

Now before we go to "OnCreate", earlier on i've mentioned that Dex2Jar screwed it up right. Let's look at "cOIcOOo" in this smali file, "OclIIOlC"

Now look at the original smali code and this one with comments.
.method private static cOIcOOo(III)Ljava/lang/String;
// private static String cOIcOOo(Int paramInt1, Int paramInt2, Int paramInt3){
    .locals 6
    sget-object byteArray1, Lcom/android/system/admin/OclIIOlC;->cOIcOOo:[B
    // byte[] byteArray1 = OclIIOlC.cOIcOOo;
    add-int/lit8 p0, p0, 0x60
    // paramInt1 = paramInt1+0x60
    add-int/lit8 paramInt3, paramInt3, 0x21
    // paramInt3 = paramInt3+0x21;
    const/4 k, 0x0
    // int k = 0;
    new-instance v0, Ljava/lang/String;
    // String v0;
    new-array byteArray2, paramInt3, [B
    // byte[] byteArray2 = new byte[paramInt3];
    if-nez byteArray1, :cond_0
    // if( byteArray1==null ){
    move v2, paramInt3
    // v2 = paramInt3;
    // }
    move v3, paramInt2
    // v3 = paramInt2;
:goto_0
    add-int/lit8 paramInt2, paramInt2, 0x1
    // paramInt2 += 1;
    // or paramInt2++;
    add-int/2addr v2, v3
    // v2 += v3;
    add-int/lit8 paramInt1, v2, -0x2
    // paramInt1 = v2 + (-0x2);
:cond_0
    int-to-byte v2, paramInt1
    aput-byte v2, byteArray2, k
    // Puts the byte value in v2 into an element of a byte array. The element is indexed by k, the array object is referenced by byteArray2.
    // byteArray2[k] = v2;
    add-int/lit8 k, k, 0x1
    // k +=0x1;
    // or k++;
    if-lt k, paramInt3, :cond_1
    // if( k>=paramInt3 ){
    const/4 v2, 0x0
    // v2 = 0x0;
    invoke-direct {v0, byteArray2, v2}, Ljava/lang/String;-><init>([BI)V
    return-object v0
    // return new String(byteArray2, v2);
:cond_1
    move v2, paramInt1
    // v2 = paramInt1;
    aget-byte v3, byteArray1, paramInt2
    // Gets a byte value of a byte array into v3. The array is referenced by byteArray1 and is indexed by paramInt2.
    // v3 = byteArray1[paramInt2];
    goto :goto_0
.end method
}

Now compare it with "HelloWorld", which I've attached here. This should be the way to finally reverse it...i think.

Ok, i've also mentioned before on why AVs and some of the tools don't work.
Most of the better Android malware nowadays uses Reflection API.
Reflection can allow a program to create a "function pointer"  and invoke the target function by using it. You can see it's common usage in ExploitKits or those Java exploits.

You will see it when you start reversing "OnCreate" function.

https://www.virustotal.com/en/file/b65c352d44fa1c73841c929757b3ae808522aa2ee3fd0a3591d4ab6759ff8d17/analysis/
SHA256: b65c352d44fa1c73841c929757b3ae808522aa2ee3fd0a3591d4ab6759ff8d17
SHA1: 40b3abcc27be12e6d091fd4db83e15f9e06fa027
MD5: e1064bfd836e4c895b569b2de4700284
File size: 82.3 KB ( 84306 bytes )
File name: file.apk
File type: Android
Tags: android faulty
Detection ratio: 2 / 47
Analysis date: 2013-05-29 14:31:37 UTC ( 1 week, 1 day ago )

Antivirus Result Update
Kaspersky HEUR:Backdoor.AndroidOS.Obad.a 20130529
DrWeb Android.Siggen.1.origin

https://www.virustotal.com/en/file/ba1d6f317214d318b2a4e9a9663bc7ec867a6c845affecad1290fd717cc74f29/analysis/
SHA256: ba1d6f317214d318b2a4e9a9663bc7ec867a6c845affecad1290fd717cc74f29
SHA1: a2ba1bacc996b90b37a2c93089692bf5f30f1d68
MD5: f7be25e4f19a3a82d2e206de8ac979c8
File size: 83.1 KB ( 85079 bytes )
File name: vti-rescan
File type: Android
Tags: android faulty
Detection ratio: 7 / 47
Analysis date: 2013-06-05 16:35:17 UTC ( 1 day, 1 hour ago )

NANO-Antivirus Trojan.Obad.bsmgrf 20130605
VIPRE Trojan.AndroidOS.Generic.A 20130605
Kaspersky HEUR:Backdoor.AndroidOS.Obad.a 20130605
ESET-NOD32 Android/Obad.B 20130605
AntiVir Android/Obad.a.2 20130605
DrWeb Android.Siggen.1.origin 20130605
Symantec Android.Obad 20130605