(Not only) Android malware analysis

The best way to fight crypto-ransomware is to have backups. But what if you make backups once a month, but want to decrypt all of the new or modified files? Is it possible? Sometimes... Recently, I had a lot of encounters with cryptography . Additionally, this year marks the 70th anniversary of the end of the Second World War. Rather unusually, this two facts combined can help us fight ransomware. We will also learn something about different kinds of ciphers and their weaknesses. Some versions of the crypto-ransomware use streaming cipher (usually RC4) to encrypt the files found on the victim's machine. However, they make a serious mistake that would get them in trouble if they were working in the Nazi's communication department. But first, let me tell you something about the idea behind the streaming ciphers. Most symmetric streaming ciphers are using on the same idea. Based on the password provided by the user, encryption/decryption algorithm creates a keystream....

In my last post I described an interesting malware family that used Mono and Lua virtual machines to obfuscate its behavior. Lately, it has been packed with new features and upgrades , which are meant as a forensic countermeasure. Let's examine these updates and see why this botnet is different from the other Android botnets. Retrospective: Lua and .NET But first, let me remind you how this malware is build. Diagram below shows one of the malware main components - SMS Broadcast Receiver. How does it work exactly? First, a BroadcastReceiver is registered in the AndroidManifest.xml file. This Broadcast Receiver, in its static initialization block, registers an n_OnReceive function  from a native library, libmonodroid.so, using a function call presented below. This call specifies the .NET function call which will be used for n_OnReceive (Z.Core.SMSReceiver), library which will be loaded (Leader.dll) and some other parameters. The Leader.dll is then loaded from li...

Recently @PaulWebSec  made me look at porn  (now, will you risk clicking on that link? ;). Well, at least he advertised it as such, but it turned out to be just another fake Android porn app, which in reality was just a ransomware. It even has a kind of NSFW icon, but you have to get the sample to see it for yourself. Anyhow, let's have a look at the code. It uses a lot of interesting permissions: camera, call log, contacts, Internet (of course), location and so on. It also has a bunch of activities, one of which is affectingly called TerrifyActivity . Overview When we start the app, AndroidManifest says it will start an Activity called MainActivity . And by looking at it it does nothing. Absolutely nothing, apart from creating some variables.  Actually , the startup code is in the MainApplication class. This, in turn, starts the MainService3 class.  A  WakeLock  is also put in place - to make sure that the device is on.  We are asked w...

Recently Kafeine identified a CP ransomware for Android . The idea was the same as with the previously identified one for Windows. Victims were presented with the Child Pornography pictures, their browsing history and their image (snapped from a camera) plus some phone-identifying features. The message said that some FBI/PRISM/NSA or any other entity wants you to pay a "fine" in order to unlock your computer. Pretty standard ransomware, not unlike the one I previously described . But, unlike the one mentioned in previous posts, this one was actually a little more complex. So, if you want a general overview, go to the Kafeine post and I'll present a look under the hood here. How to do a ransomware? Well, it's not that easy. As we've seen previously you can just display a message every couple of seconds. We've seen that the previous app used scheduleAtFixedRate function to ensure that the lock message is always displayed. This app also makes sure that it i...

Recently I came across the Android ransomware sample (sha256:  c0cb135eef45bb8e411d47904ce638531d53473729c7752dc43c6d55d5ed86f8 ). This sample is interesting for a couple of reasons, but there is one truly bizarre property of this APK file. It has a raw file included, which actually was a Direct3D library signed by Microsoft . Why a Windows-based DLL file is included in the APK file is just beyond me. Anyhow, let's get back to business and have a look at the sample and what it does. Quick look First things first. The app pretends to be a NFS Hot Pursuit Android game, straight from the EA. Both the app name and the icon look like a legitimate game. However, upon running, it displays a screen with an information that your phone has been blocked due to the fact that the user watched child pornography. The ransomware targets both Russians and Ukrainians and has text in both languages. The code below checks whether the SimCountryIso is equal to "ua" and changes the displa...