(Not only) Android malware analysis

So I recently tweeted about some interesting Android app sample . This app either is or pretends to be an Iranian banking app. I couldn't take a closer look at it (there is a bit of a language problem for me), however it uses the Ansar Bank name and graphics (as you can see on a screenshot below) and also uses a very interesting text messages feature that I was not aware at all. The curious case of the SMS protocol Text message protocol is pretty straightforward on the high level: it allows you to send a 140-byte message to the other phone. Wait, I surely meant 160 bytes, right? No, it's a 140 bytes, but it's using a plain 7-bit ASCII encoding without those fancy characters like the one at the beginning of my name. This allows you to send precisely 160 ASCII characters. As you probably all know, we can send more than 160 characters, but it will be broken into several messages. However, mobile phones seem to be OK with that and let you create a long message a...

Few days ago Blue Coat published a whitepaper about so-called "The Inception Framework" : a commercial-grade malware used in some more or less targeted attacks. The paper describes the details (with some nice pictures) and outlines an Android app used in this attacks . Because AV companies seem to stick with the "CloudAtlas" name in their signatures for this malware I will use the same name. Let's dive a bit into the most interesting bits, which I haven't seen in the Android malware before. The "you can't see the log name" trick First things first: it's a commercial-grade malware and is written as any commercial software would be - one class has a single responsibility, everything is logged and the code looks clean even after the decompilation. If you're a software engineer in a big company you probably recognize the function names presented on the screenshot below (maybe you even use the same names in your project?). It ...