(Not only) Android malware analysis

The best way to fight crypto-ransomware is to have backups. But what if you make backups once a month, but want to decrypt all of the new or modified files? Is it possible? Sometimes... Recently, I had a lot of encounters with cryptography . Additionally, this year marks the 70th anniversary of the end of the Second World War. Rather unusually, this two facts combined can help us fight ransomware. We will also learn something about different kinds of ciphers and their weaknesses. Some versions of the crypto-ransomware use streaming cipher (usually RC4) to encrypt the files found on the victim's machine. However, they make a serious mistake that would get them in trouble if they were working in the Nazi's communication department. But first, let me tell you something about the idea behind the streaming ciphers. Most symmetric streaming ciphers are using on the same idea. Based on the password provided by the user, encryption/decryption algorithm creates a keystream....

In my last post I described an interesting malware family that used Mono and Lua virtual machines to obfuscate its behavior. Lately, it has been packed with new features and upgrades , which are meant as a forensic countermeasure. Let's examine these updates and see why this botnet is different from the other Android botnets. Retrospective: Lua and .NET But first, let me remind you how this malware is build. Diagram below shows one of the malware main components - SMS Broadcast Receiver. How does it work exactly? First, a BroadcastReceiver is registered in the AndroidManifest.xml file. This Broadcast Receiver, in its static initialization block, registers an n_OnReceive function  from a native library, libmonodroid.so, using a function call presented below. This call specifies the .NET function call which will be used for n_OnReceive (Z.Core.SMSReceiver), library which will be loaded (Leader.dll) and some other parameters. The Leader.dll is then loaded from li...

In December I attended a (really great!) Botconf 2014 conference. During that conferece I gave a  lightning talk about an interesting Android malware sample that (presumably) used Lua and Mono (hence, .NET) as a way of obfuscation. Very recently  @tbiehn  Tweeted to me a solution for a problem that I run into during the analysis. So now, below, you can find details about the weird Lua/.NET/Java Android sample . It says "Please wait, loading data" Quick overview It starts fairly innocent, with an app called Metrics.Me and it has a pretty standard malware permissions, as can be seen on a screenshot below. It uses a VKontakte icon, probably to pose as a kind of social media app. The main and only screen of this app is shown above. Let's start with the usual place: the SMSReceiver . And now things get a little complicated. There are a lot of references to the "monodroid". It turns out that this is actually a Mono (.NET) implementation in Andro...

Few days ago Blue Coat published a whitepaper about so-called "The Inception Framework" : a commercial-grade malware used in some more or less targeted attacks. The paper describes the details (with some nice pictures) and outlines an Android app used in this attacks . Because AV companies seem to stick with the "CloudAtlas" name in their signatures for this malware I will use the same name. Let's dive a bit into the most interesting bits, which I haven't seen in the Android malware before. The "you can't see the log name" trick First things first: it's a commercial-grade malware and is written as any commercial software would be - one class has a single responsibility, everything is logged and the code looks clean even after the decompilation. If you're a software engineer in a big company you probably recognize the function names presented on the screenshot below (maybe you even use the same names in your project?). It ...

I like FUDs, because they must show creativity either in packing or in the code. Anyhow, they are almost always interesting to analyze. Recently I came across a "porn" app targeting Italy (md5:  0995aceaeb8e338aff542ab3f1d8dab4 ). When you run it it displays an ansa.it website, which I guess is a kind of Italian news site. But what it does in the background is really interesting. Quick look First off the app is still in the making and let me tell you the author devotes 5 hours a day to make it work! He (or she) is really trying to make it both FUD and powerful and I have to tell you that it starts to shape up with some nifty features. There are still a lot of blanks, which maybe will be filled in in the future. Look at this beautiful icon (remember that it is supposed to be a porn app): Second up, the strings. They are encrypted using DES encryption in a famous Adobe mode  with "Some Key" key. All of the strings seem to be encrypted, even the ones popul...

Recently I came across the Android ransomware sample (sha256:  c0cb135eef45bb8e411d47904ce638531d53473729c7752dc43c6d55d5ed86f8 ). This sample is interesting for a couple of reasons, but there is one truly bizarre property of this APK file. It has a raw file included, which actually was a Direct3D library signed by Microsoft . Why a Windows-based DLL file is included in the APK file is just beyond me. Anyhow, let's get back to business and have a look at the sample and what it does. Quick look First things first. The app pretends to be a NFS Hot Pursuit Android game, straight from the EA. Both the app name and the icon look like a legitimate game. However, upon running, it displays a screen with an information that your phone has been blocked due to the fact that the user watched child pornography. The ransomware targets both Russians and Ukrainians and has text in both languages. The code below checks whether the SimCountryIso is equal to "ua" and changes the displa...

Most of the malware based on the SMS C&C communication channel is not compatible with Android 4.4 KitKat. This is due to the fact that KitKat introduced a concept of one messaging app, which all other apps had to go trough before they send or handle a received text message. This prevented malware from hiding received short messages or sending without saving them in the "Sent" folder. Well, it wasn't hard to predict that this state of affairs wouldn't last long and that malware authors would eventually catch up. Malware described here not only supports KitKat, but also uses an open-source SMS encryption tool  as a basis for its code. Let's have a look at the insides of the new sample (hash: 84e2e9e8430792b583d02d3cc1bf8535 ) and let's call it SmsSecure, just for the sake of brevity.