(Practical) Android Malware Analysis

La Nuit du Hack 2016

Paul AMAR / @PaulWebSec

https://slides.com/paul38/

# who

Paul [at] SensePost [.dot.] com     

@PaulWebSec / GitHub: PaulSec

why do we care?

What?

Static Analysis (Androguard, Dex2Jar, apktool, ...)    

Dynamic Analysis (DroidBox, CuckooDroid, ...)  

What to do? Where to look for? How to do it?   

how?

Using Kali Linux:                                                                              

> Create a new Machine  or use your existing one

Samples available here (Mega.nz, 5 samples)                

Androguard

Disassembles/Decompiles Android apps                     

Different tools: androlyze, androdis, androauto, ...

https://github.com/androguard/androguard

Androguard 101

Let's analyze the APK!

Get in the folder:

$ cd ~/Tools/androguard

$ python ./androlyze.py -s

Androguard 102

In the shell, load the APK:

sample = APK('/path/to/file.apk')

sample.get_permissions()
sample.get_activities()        
sample.show()                        
....                                                 

Androguard 103

d = dvm.DalvikVMFormat(a.get_dex())               

for _class in d.get_classes():                                         
    print _class.get_name()                               

for method in _class.get_methods():

print method.get_name()

and in action!

but.. apk, apk..

$ unzip /path/to/file.apk

what's in there?

META-INF: meta info directory
lib: directory containing compiled code
res: resources directory
assets: application assets directory
AndroidManifest.xml: additional manifest file describing name, version, access rights and referenced library files for the app
classes.dex: the main Dalvik Executable file
resources.arsc: precompiled resources e.g. binary XML

APKtool

Disassembles/rebuilds resources to JAR/APK

$ apktool d /path/to/file.apk -o out/

$ apktool b foo/

usually, *phun* is in

*.dex files. 

DEX = Dalvik EXecutable file         

code that runs in the Dalvik VM

We need to convert it to a JAR archive

dex2jar

A set of tool to work with Android .dex and java .class files

Read/write the Dalvik Executable (.dex) file, Disassemble .dex to smali files, Convert .dex file to .class files (zipped as jar)

https://github.com/pxb1988/dex2jar

dex2jar 101

$ /path/to/d2j-dex2jar.sh /path/to/file.dex

JD-GUI

At that point, you can use any Java decompiler.

java -jar jd-gui-1.1.0.jar

http://jd.benow.ca/                                                      

https://github.com/java-decompiler/jd-gui

TADAM!

feeling a bit lazy?

https://gist.github.com/PaulSec/39245428eb74577c5234

but wait, there's more..

jadx 101 (RLY?)

$ jadx /path/to/file.apk          

$ jadx-gui /path/to/file.apk

So, now...

Got the source code, might contain hundred of classes.

Thousand lines of code.                                                                         

Where/What to look for?

observations

Often..

• Using HTTP to communicate (and/or SMS)
  
• no SSL certificate for the panels
• IMEI used as the victim's identifier
  
• Encrypting using AES
• Encoding data in Base64 (still..)
  

Low hanging fruit

Save the source files (*.java) in:

eg. /tmp/sample_test

And search for specific terms:

$ cd /tmp/sample_test
$ grep -r -i 'cipher' .        
$ grep -r -i 'http://' .        
$ grep -r -i 'base64' .     
....                                       

then,

Analyze how the communication  works                

Retrieve encryption keys                                                    

See how the app interacts on the filesystem        

Dynamic analysis

adb

Stands for: Android Debug Bridge

Command line tool to communicate with

emulator or connected devices

https://developer.android.com/tools/help/adb.html

https://github.com/maldroid/adb_cheatsheet              

adb 101

List the devices already connected

$ adb devices

$ adb install /path/to/file.apk

$ adb push/pull <local> <remote>

Droidbox

.. and retrieves bunch of information:

• Incoming/outgoing network data
• File read and write operations
• Sent SMS and phone calls, ...
  

Droidbox

Create a new AVD (Android Virtual Device),

eg. Nexus 4, Android version 4.2.1

$ android

Start the emulator

$ ./startemu.sh <AVD name>

$ ./droidbox.sh /path/to/file.apk

burp suite setup

In order to monitor the HTTP(s) traffic

Configure a proxy on your phone:            

• Wifi, Press <Network  Name>
  
• Modify network
• Show advanced options
• Insert the proxy details

And launch the app.                                   

pracs

Link is here (Mega.nz)

funny samples (1/4)

Solution

FUNNY samples (2/4)

String obfuscation - XOR

sha256:99c4d780c0143af20191d6ffb0cc206605e397330ddd6a84185df1d112c1e963

Solution

Funny samples (3/4)

sha256:f75500da9728d95e33e40f9a1d8bf29959d5aa89827aeabfb3aaaa02a488dd39

FUNNY SAMPLES (4/4)

Last sample?

Challenge for La Nuit du Hack? 

https://mega.nz/#!kYBDwbLa!N65QIwf_8vGTM1jjoJFav7-HfmtS29BBn5wjmVtsRxI 

Specially crafted for La Nuit du Hack!

Goal? Retrieve the flag!

wrap-up

This is just an introduction.                            

Lot of research regarding obfuscation:

Dex Education - Practicing Safe Dex | Black Hat 2012

DEF CON 22 - Tim Strazzere and Jon Sawyer - Android Hacker Protection Level 0

Android 'Awesome Security'

Red Naga Training materials (highly recommended)

how to keep informed?

VirusTotal (#android #malware)                    

koodous.com malware community               

Contagio mini-dump (+ mailing)                      

amtrckr.info (Android Malware Tracker)       

questions?