(Not only) Android malware analysis

When I moved to my new apartment I discovered a lot of old, mostly networking-related, equipment that I was meaning to either sell or throw out, but I never got to it. Recently I also bought an Arduino and decided to learn something about a lower level of reverse engineering (e.g. the CTF binaries from RHme 2 ). This two things combined mean it's time for some router reverse engineering! A word of warning: before I started playing with low level RE I didn't know anything about electronics. If you have some experience with hardware hacking, this post may be a bit too basic. Typing random numbers into a search bar My victim is the Edimax EW-7206APg wireless router. The very first thing to do is to remove the screws and look around the PCB (yes, I know that the lighting is horrible). As you can see there's a huge chip in the middle of the board and some additional smaller ones to the left and next to the Ethernet port. They all have markings, so obviously my first i...

iBanking malware seems to be on the rise recently. It is not a new malware, it's circulating for more than a year now, but it seems to be the go-to choice for some of the more popular e-banking attacks. It's usually coupled with the PC infection (by some webinject-capable malware), which convinces the user to install either a "specially crafted" banking app, antivirus solution or some other uses trustworty-sounding name. Anyhow, I recently got my hands on two interesting things: one is the "new" iBanking sample, which tries to fool Android > 4.3 SMS_DELIVER mechanism. The second one is the panel and the builder of the iBanking. Let's have a look, but first a quick recap of iBanking features and modus operandi. We will be looking at this sample . Templating iBanking has a dozen of what it calls "templates". Each template is in fact one of the apps that iBanking pretends to be. So you can have a template for a specific bank, a templat...

Few days ago Blue Coat published a whitepaper about so-called "The Inception Framework" : a commercial-grade malware used in some more or less targeted attacks. The paper describes the details (with some nice pictures) and outlines an Android app used in this attacks . Because AV companies seem to stick with the "CloudAtlas" name in their signatures for this malware I will use the same name. Let's dive a bit into the most interesting bits, which I haven't seen in the Android malware before. The "you can't see the log name" trick First things first: it's a commercial-grade malware and is written as any commercial software would be - one class has a single responsibility, everything is logged and the code looks clean even after the decompilation. If you're a software engineer in a big company you probably recognize the function names presented on the screenshot below (maybe you even use the same names in your project?). It ...

I like FUDs, because they must show creativity either in packing or in the code. Anyhow, they are almost always interesting to analyze. Recently I came across a "porn" app targeting Italy (md5:  0995aceaeb8e338aff542ab3f1d8dab4 ). When you run it it displays an ansa.it website, which I guess is a kind of Italian news site. But what it does in the background is really interesting. Quick look First off the app is still in the making and let me tell you the author devotes 5 hours a day to make it work! He (or she) is really trying to make it both FUD and powerful and I have to tell you that it starts to shape up with some nifty features. There are still a lot of blanks, which maybe will be filled in in the future. Look at this beautiful icon (remember that it is supposed to be a porn app): Second up, the strings. They are encrypted using DES encryption in a famous Adobe mode  with "Some Key" key. All of the strings seem to be encrypted, even the ones popul...

Recently I came across the Android ransomware sample (sha256:  c0cb135eef45bb8e411d47904ce638531d53473729c7752dc43c6d55d5ed86f8 ). This sample is interesting for a couple of reasons, but there is one truly bizarre property of this APK file. It has a raw file included, which actually was a Direct3D library signed by Microsoft . Why a Windows-based DLL file is included in the APK file is just beyond me. Anyhow, let's get back to business and have a look at the sample and what it does. Quick look First things first. The app pretends to be a NFS Hot Pursuit Android game, straight from the EA. Both the app name and the icon look like a legitimate game. However, upon running, it displays a screen with an information that your phone has been blocked due to the fact that the user watched child pornography. The ransomware targets both Russians and Ukrainians and has text in both languages. The code below checks whether the SimCountryIso is equal to "ua" and changes the displa...

Most of the malware based on the SMS C&C communication channel is not compatible with Android 4.4 KitKat. This is due to the fact that KitKat introduced a concept of one messaging app, which all other apps had to go trough before they send or handle a received text message. This prevented malware from hiding received short messages or sending without saving them in the "Sent" folder. Well, it wasn't hard to predict that this state of affairs wouldn't last long and that malware authors would eventually catch up. Malware described here not only supports KitKat, but also uses an open-source SMS encryption tool  as a basis for its code. Let's have a look at the insides of the new sample (hash: 84e2e9e8430792b583d02d3cc1bf8535 ) and let's call it SmsSecure, just for the sake of brevity.

My first post is about Sandrorat, a fairly new RAT tool that was prominent for being a part of a Polish spam campaign . The analyzed sample hash is bed05d8eace6a7ebc5dec7141ea4b9cc559f1b2aab8848e2c79df7a79de39b9d . Sample was obtained thanks to The Honeynet Project . Everything is synthetic First part will be about a little known synthetic methods and the way Sandrorat uses them to obfuscate the code . This sample declared three different services: