(Not only) Android malware analysis

iBanking malware seems to be on the rise recently. It is not a new malware, it's circulating for more than a year now, but it seems to be the go-to choice for some of the more popular e-banking attacks. It's usually coupled with the PC infection (by some webinject-capable malware), which convinces the user to install either a "specially crafted" banking app, antivirus solution or some other uses trustworty-sounding name. Anyhow, I recently got my hands on two interesting things: one is the "new" iBanking sample, which tries to fool Android > 4.3 SMS_DELIVER mechanism. The second one is the panel and the builder of the iBanking. Let's have a look, but first a quick recap of iBanking features and modus operandi. We will be looking at this sample . Templating iBanking has a dozen of what it calls "templates". Each template is in fact one of the apps that iBanking pretends to be. So you can have a template for a specific bank, a templat...

Most of the malware based on the SMS C&C communication channel is not compatible with Android 4.4 KitKat. This is due to the fact that KitKat introduced a concept of one messaging app, which all other apps had to go trough before they send or handle a received text message. This prevented malware from hiding received short messages or sending without saving them in the "Sent" folder. Well, it wasn't hard to predict that this state of affairs wouldn't last long and that malware authors would eventually catch up. Malware described here not only supports KitKat, but also uses an open-source SMS encryption tool  as a basis for its code. Let's have a look at the insides of the new sample (hash: 84e2e9e8430792b583d02d3cc1bf8535 ) and let's call it SmsSecure, just for the sake of brevity.