(Not only) Android malware analysis

In my last post I described an interesting malware family that used Mono and Lua virtual machines to obfuscate its behavior. Lately, it has been packed with new features and upgrades , which are meant as a forensic countermeasure. Let's examine these updates and see why this botnet is different from the other Android botnets. Retrospective: Lua and .NET But first, let me remind you how this malware is build. Diagram below shows one of the malware main components - SMS Broadcast Receiver. How does it work exactly? First, a BroadcastReceiver is registered in the AndroidManifest.xml file. This Broadcast Receiver, in its static initialization block, registers an n_OnReceive function  from a native library, libmonodroid.so, using a function call presented below. This call specifies the .NET function call which will be used for n_OnReceive (Z.Core.SMSReceiver), library which will be loaded (Leader.dll) and some other parameters. The Leader.dll is then loaded from li...

In December I attended a (really great!) Botconf 2014 conference. During that conferece I gave a  lightning talk about an interesting Android malware sample that (presumably) used Lua and Mono (hence, .NET) as a way of obfuscation. Very recently  @tbiehn  Tweeted to me a solution for a problem that I run into during the analysis. So now, below, you can find details about the weird Lua/.NET/Java Android sample . It says "Please wait, loading data" Quick overview It starts fairly innocent, with an app called Metrics.Me and it has a pretty standard malware permissions, as can be seen on a screenshot below. It uses a VKontakte icon, probably to pose as a kind of social media app. The main and only screen of this app is shown above. Let's start with the usual place: the SMSReceiver . And now things get a little complicated. There are a lot of references to the "monodroid". It turns out that this is actually a Mono (.NET) implementation in Andro...

Recently @PaulWebSec  made me look at porn  (now, will you risk clicking on that link? ;). Well, at least he advertised it as such, but it turned out to be just another fake Android porn app, which in reality was just a ransomware. It even has a kind of NSFW icon, but you have to get the sample to see it for yourself. Anyhow, let's have a look at the code. It uses a lot of interesting permissions: camera, call log, contacts, Internet (of course), location and so on. It also has a bunch of activities, one of which is affectingly called TerrifyActivity . Overview When we start the app, AndroidManifest says it will start an Activity called MainActivity . And by looking at it it does nothing. Absolutely nothing, apart from creating some variables.  Actually , the startup code is in the MainApplication class. This, in turn, starts the MainService3 class.  A  WakeLock  is also put in place - to make sure that the device is on.  We are asked w...

iBanking malware seems to be on the rise recently. It is not a new malware, it's circulating for more than a year now, but it seems to be the go-to choice for some of the more popular e-banking attacks. It's usually coupled with the PC infection (by some webinject-capable malware), which convinces the user to install either a "specially crafted" banking app, antivirus solution or some other uses trustworty-sounding name. Anyhow, I recently got my hands on two interesting things: one is the "new" iBanking sample, which tries to fool Android > 4.3 SMS_DELIVER mechanism. The second one is the panel and the builder of the iBanking. Let's have a look, but first a quick recap of iBanking features and modus operandi. We will be looking at this sample . Templating iBanking has a dozen of what it calls "templates". Each template is in fact one of the apps that iBanking pretends to be. So you can have a template for a specific bank, a templat...

So I recently tweeted about some interesting Android app sample . This app either is or pretends to be an Iranian banking app. I couldn't take a closer look at it (there is a bit of a language problem for me), however it uses the Ansar Bank name and graphics (as you can see on a screenshot below) and also uses a very interesting text messages feature that I was not aware at all. The curious case of the SMS protocol Text message protocol is pretty straightforward on the high level: it allows you to send a 140-byte message to the other phone. Wait, I surely meant 160 bytes, right? No, it's a 140 bytes, but it's using a plain 7-bit ASCII encoding without those fancy characters like the one at the beginning of my name. This allows you to send precisely 160 ASCII characters. As you probably all know, we can send more than 160 characters, but it will be broken into several messages. However, mobile phones seem to be OK with that and let you create a long message a...

Few days ago Blue Coat published a whitepaper about so-called "The Inception Framework" : a commercial-grade malware used in some more or less targeted attacks. The paper describes the details (with some nice pictures) and outlines an Android app used in this attacks . Because AV companies seem to stick with the "CloudAtlas" name in their signatures for this malware I will use the same name. Let's dive a bit into the most interesting bits, which I haven't seen in the Android malware before. The "you can't see the log name" trick First things first: it's a commercial-grade malware and is written as any commercial software would be - one class has a single responsibility, everything is logged and the code looks clean even after the decompilation. If you're a software engineer in a big company you probably recognize the function names presented on the screenshot below (maybe you even use the same names in your project?). It ...

Recently Kafeine identified a CP ransomware for Android . The idea was the same as with the previously identified one for Windows. Victims were presented with the Child Pornography pictures, their browsing history and their image (snapped from a camera) plus some phone-identifying features. The message said that some FBI/PRISM/NSA or any other entity wants you to pay a "fine" in order to unlock your computer. Pretty standard ransomware, not unlike the one I previously described . But, unlike the one mentioned in previous posts, this one was actually a little more complex. So, if you want a general overview, go to the Kafeine post and I'll present a look under the hood here. How to do a ransomware? Well, it's not that easy. As we've seen previously you can just display a message every couple of seconds. We've seen that the previous app used scheduleAtFixedRate function to ensure that the lock message is always displayed. This app also makes sure that it i...