Android Malware Analysis: SmsWorker ( ͡° ͜ʖ ͡°) (day 78)

Have you ever wonder how to do android malware analysis? Do you want to know how to dissect it and understand the mechanism inside the android malware?

if yes, in this post we will do so some analysis on one of the samples of android malware from china it cames from Baidu antivirus, you can take a look at the samples from this link: https://github.com/ashishb/android-malware/tree/master/BreakBottleneck 

if no, you can just ignore this whole post LOL :)

(kudos for the owner of the GitHub page you make my life easier)

Please be careful when analyzing the samples, don't install it at your real device but install it at the android emulator or contained environment. I'm not responsible for any incident that happens to your device

The idea of this post is to give you some insight on how to do analysis on android malware. We will try to do static analysis and then go to the dynamic analysis.

Remember, the result that you will see here is based on my analysis and methodology, you may have a different approach to analyze this sample but it's up to you if you want to follow it or not.

In short, at the end of the analysis, I found that the malware has a capability to:

1. Silently to download an app and install it into your mobile 
2. Capable of sending an SMS without your consent

Also, I found some interesting stuff along with the analysis such as: how mobile GPRS work in China and Public and private key RSA store inside the application

Decompile the APP (Static Analysis)

When I start analyzing android malware, I just straightly decompile the .apk file using apktool (to get smali source code), enjarify (convert apk to jar) and  procyon decompiler (jar to source code)



by getting the smali bytecode of the program I would able to circumvent at any defense mechanism (anti-reverse engineering) that the malware has but fortunately this sample doesn't show any indication of anti-re mechanism so mostly I used apktool to get other resources on the application such as permission, library and resources file of the app

rest of it such as enjarify and procyon basically to get the java source code so I can try to understand the program in more detail.

enjarify: https://github.com/google/enjarify
procyon-decompiler: https://bitbucket.org/mstrobel/procyon/downloads/

as you can see here this is the result of tools, notice that there is some class that named with alphabet don't worry this just means that the tools are not able to retrieve some name of class so they named it based on their algorithm

Let's take a look at the permission file of the android (AndroidManifest.xml) this define how many permission that the application needs to have in order to run it correctly

 'android.permission.INTERNET',
 'android.permission.INSTALL_PACKAGES',
 'android.permission.ACTION_VIEW',
 'android.permission.WRITE_EXTERNAL_STORAGE',
 'android.permission.RESTART_PACKAGES',
 'android.permission.MOUNT_UNMOUNT_FILESYSTEMS',
 'android.permission.READ_PHONE_STATE',
 'android.permission.ACCESS_COARSE_LOCATION',
 'android.permission.ACCESS_NETWORK_STATE',
 'android.permission.READ_PHONE_STATE',
 'android.permission.WRITE_EXTERNAL_STORAGE',
 'android.permission.MOUNT_UNMOUNT_FILESYSTEMS',
 'android.permission.RECEIVE_SMS',
 'android.permission.RECEIVE_WAP_PUSH',
 'android.permission.WRITE_APN_SETTINGS',
 'android.permission.RECEIVE_BOOT_COMPLETED',
 'android.permission.WAKE_LOCK',
 'android.permission.WRITE_APN_SETTINGS',
 'android.permission.CHANGE_NETWORK_STATE',
 'android.permission.ACCESS_WIFI_STATE',
 'android.permission.CHANGE_WIFI_STATE',
 'android.permission.SET_WALLPAPER',
 'android.permission.SEND_SMS'
The one that I bolded it with red is the focus on our analysis, we can see that by just analyzing the permission file we can get a general view of how the application work

In this case, it is able to directly install a package and Malicious applications can use this to add new applications with arbitrarily powerful permissions. Next is to send and receive SMS, Malicious applications may cost you money by sending messages without your confirmation.

Installing the application at the background 

when I look around the permission file I found out that the application register a broadcast receiver and service that responsible for installing an application silently

<receiver android:name="myreceiver.SilenceReceiver">
<intent-filter>
<action android:name="com.ydbl.action.silenceinstall">
</action>
<category android:name="android.intent.category.DEFAULT">
</category>
</intent-filter>
</receiver>

<receiver android:name="myreceiver.InstallReceiver">
<intent-filter>
<action android:name="android.intent.action.PACKAGE_ADDED">
</action>
<data android:scheme="package">
</data>
</intent-filter>
</receiver>

<service android:name="myreceiver.DownloadService">
<intent-filter>
<action android:name="com.ydbl.action.download">
</action>
<category android:name="android.intent.category.DEFAULT">
</category>
</intent-filter>
</service>

I take a look at each of the class and figure out the workflow of the malware use this three files together

First it starts at myreceiver.DownloadService class is a service class that is running in the background. The class will send a broadcast named "com.ydbl.action.silenceinstall" to the device with two parameters apkname and pkgname

the intent broadcast matches with intent filter from myreceiver.SilenceReceiver this means that the broadcast will be received by this class and as you can see from the diagram this class will install the application based on the value sent by the service class

after the installation complete myreceiver.InstallReceiver will send a notification to the backend server said that the following device has successfully installed an application

Sending and Receiving sms:

looking at the permission file again we can see that there is two class register to handle the SMS:

<receiver android:name="com.android.service.PlugSmsRecevier">
<intent-filter android:priority="1000">
<action android:name="android.provider.Telephony.SMS_RECEIVED">
</action>
<category android:name="android.intent.category.DEFAULT">
</category>
</intent-filter>
</receiver>

<activity android:configChanges="0x000000A0" android:name=".SmsActivity" android:screenOrientation="1">

one is for receiving sms and the other one is for sending an SMS

on com.android.service.PlugSmsReceiver



First, the class expecting intent with "android.provide.Telephone.SMS_RECEIVED" and the intent must contain an object with index pdus inside the object it will have the source number and the SMS content

unfortunately, I could not find any class that has a connection to .SmsActivity I think it's because the decompiler failed to get original class name. So I have to improvise by doing string analysis to do source code by searching for any class that contains the keyword " SmsManager" after a couple of minutes I found out an unnamed class that has the capability to send a message

 



basically, when the function is called it takes two parameters, s will contain the destination number whereas s2 will contain the message that will be sent

Interesting finding:

When looking around again through the rest of the file I found this configuration hardcoded beneath the source code



I guess this is just for setting for personal private communication since it contains APN(Access Point Name) credential, when I try to do some research about what is config means it lead to me to this list of APN https://github.com/signalapp/Signal-Android/blob/master/apntool/apnlists/cyanogenmod.xml

Also, I found this strange configuration beneath the apk called "smsrpt"



I think rpt stands for repeater since SMS repeater use to a message for one number how many times you want, I try to check the IP address but it's not active anymore

Lastly, I found the private and public key used by the app:



I try to found the relation of this private key to the app if there is any encryption or decryption happen inside the app and from a quick result of static analysis.



we can see that the app did do decryption by calling library called "manbodecrypt"



when I try to list the function inside the library we can see that the function name gives us a clue about the operation. I will not go into detail about this

Dynamic Analysis:

I think in dynamic analysis, I don't really much information since most of the link that I found is already dead and this app can only run in ARM device. I try to run it in my AVD but it really slow and keep show me this warning

I try to invoke the silence installer by putting an apk file at the external directory so the app can get and install once I send the correct broadcast



The app did receive my intent but it's not responding anything and just crash again. I also do the same thing with the sms activity but it always lead to the same result

such a shame :(

Conclusion:

I think from all the information we get the app we just analyze here is a trojanized app, it means malicious actor just get a legitimate app from the china app market then insert a bunch of malicious code then repackage it again and release it to the internet

If you have a different opinion about the malware I'm open to suggestion  

Okay we are done I think this is all I can give to you

That's all folks I hope you can get some insight on how to start doing android malware analysis

See you at the next post :)