What are you doing? – DSEncrypt Malware
Executive Summary
Have you ever downloaded and installed a large Android application
that had very few actual UI elements or functionality? Recently,
FireEye Labs mobile security researchers have discovered a new kind of
mobile malware that encrypts an embedded Android application with an
attachment in an asset folder – concealing all malicious activities
within a seemingly benign application.
The malware app disguises itself as the Google Play store app,
placing its similar icon close to the real Google Play store icon on
the homescreen. Once installed, the hacker uses a dynamic DNS server
with the Gmail SSL protocol to collect text messages, signature
certificates and bank passwords from the Android devices.
The relationship between the main application, the attached
application and the malicious classes are shown below.
[caption id="attachment_5675" align="alignnone"
width="552"] href="/content/dam/legacy/blog/2014/06/relation.png"> class=" wp-image-5675 landscape-med"
alt="Fig. 1. The relationship of the mask app and the embedded malware. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/relation-dns1.png"
width="552" height="251" /> Fig. 1. The relationship of the
masked app and the embedded malware.[/caption]
The malware package name is com.sdwiurse and the app title is “google
app stoy.” Android users can’t remove the app once the device is
infected because the “uninstall” function is disabled and the app
continues to run as services in the back-end. These services can be
killed manually but will restart once the Android phone is restarted.
Owing to the unique nature of how the malware is packaged, as of June
13, 2014, href="https://www.virustotal.com/intelligence/search/">the Virus
Total score for this app is only 3 out of 51 anti-virus vendors.
Because most vendors only use signature-based algorithms to detect
malware, they fail to detect the malicious content concealed within
apps that appear to be basic or run-of-the-mill.
[caption id="attachment_5700" align="alignnone"
width="533"] href="/content/dam/legacy/blog/2014/06/vt06131.png"> class=" wp-image-5700 landscape-med"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/vt06131.png"
width="533" height="158" /> Fig. 2. The Virus Total detection
out of 51 AV vendors. The score was taken on 06/13/2014.[/caption]
The app we observed only has 711 lines of code but is over 1.7MB in
size upon downloading. The single largest file, named “ds,” is
embedded in the asset folder and is 597KB. After decryption and
decompression however, the real dex package file expands up to 2.2MB
with the full malware. The little amount of code in the superficial
app is one of the evasion techniques used by the hackers to mask the
malicious classes that swell the app’s size.
User Experience
After installation, a new icon of “googl app stoy” is shown on the
Android homescreen. The icon is the same as “Google Play” to confuse
users into clicking it. Once clicked, the app asks for administrator
privileges of the device as shown in figure three.
[caption id="attachment_5681" align="alignnone"
width="547"] href="/content/dam/legacy/blog/2014/06/activate.png"> class=" wp-image-5681 landscape-med"
alt="Fig. 3. The newly installed icon on Android desktop and the activation page. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/activate.png"
width="547" height="482" /> Fig. 3. The newly installed icon
on the Android desktop and the activation page.[/caption]
When we observe the app in action, the sole user interface for the
app contains pops up saying “Program Error” and “It’s Deleted!” when
translated to English from Korean. Next, the app terminates and a
notification message appears reading “Unfortunately, google app stoy
has stopped.” After this occurs, the app icon on the homescreen is
removed, tricking the user into thinking it’s gone as shown in figure four.
[caption id="attachment_5683" align="alignnone"
width="541"] href="/content/dam/legacy/blog/2014/06/desktop.png"> class=" wp-image-5683 landscape-med"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/desktop1.png"
width="541" height="310" /> Fig. 4. The misleading
"uninstalling" page and Toast message.[/caption]
However, when opening “Setting->Apps,” we can still find the app
in the “Downloaded” tab and “Running Apps” tab. Furthermore, in the
“Downloaded” tab, the app cannot be stopped or uninstalled:
[caption id="attachment_5684" align="alignnone"
width="547"] href="/content/dam/legacy/blog/2014/06/setting-download.png"> class=" wp-image-5684 landscape-med"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/setting-download.png"
width="547" height="457" /> Fig. 5. The app can't be removed
in the "Settings-Downloaded" page.[/caption]
In the “Running Apps” tab, there are five services running that were
started by the malicious app:
1. uploadContentService
2. UninstallerService
3. SoftService
4. uploadPhone
5. autoRunService
[caption id="attachment_5685" align="alignnone"
width="548"] href="/content/dam/legacy/blog/2014/06/setting-running.png"> class=" wp-image-5685 landscape-med"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/setting-running.png"
width="548" height="308" /> Fig. 6. The 5 background services
started by the app. You won't discover them unless digging into the
long list of "Running App" tab.[/caption]
Decryption
The file is encrypted using the javax.crypto package of Java
Cryptographic Extension (JCE) framework as shown below.
[caption id="attachment_5686" align="alignnone"
width="422"] href="/content/dam/legacy/blog/2014/06/decipher.png"> class=" wp-image-5686 landscape-sm" alt="Fig. 7. Decipher code. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/decipher.png"
width="422" height="126" /> Fig. 7. Decipher code.[/caption]
The cryptographic algorithm is based on the Data Encryption Standard
(DES). The key string is “gjaoun” as shown in the code below. After
the file is decrypted, it's loaded as the dex class:
[caption id="attachment_5688" align="alignnone"
width="488"] href="/content/dam/legacy/blog/2014/06/ds.png"> class=" wp-image-5688 landscape-sm"
alt="Fig. 8. The embedded and encrypted dex file. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/ds.png"
width="488" height="410" /> Fig. 8. The code of decryption and
class loading for the embedded file.[/caption]
All the malicious activities and services happen in the loaded dex file.
Malicious Methods
In the source code of the malicious dex package, “class.dex” is
decompressed from the decrypted file “x.zip.” Analyzing this code, we
found there are three ways to steal private information from the
infected Android device. We will first introduce how the malware works
and then analyze the network traffic as evidence of the malicious behaviors.
1. SMS Message Theft
[caption id="attachment_5689" align="alignnone"
width="542"] href="/content/dam/legacy/blog/2014/06/code-sms1.png"> class=" wp-image-5689 landscape-med"
alt="Fig. 9. The code to steal personal SMS. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/code-sms1.png"
width="542" height="286" /> Fig. 9. The code to steal personal SMS.[/caption]
In the code, ak40.txt is a file in /storage/sdcard0/temp/ folder
containing a string. When the content equals to “1,” the SMS message
is sent to an email address. The email address and password are stored
among other files in /storage/sdcard0/temp/. The hacker is smart
enough to use the Gmail SSL protocol to evade the signature detection
in network traffic by most AV vendors.
2. Signature Certificate and Key Theft
[caption id="attachment_5691" align="alignnone"
width="546"] href="/content/dam/legacy/blog/2014/06/code-cert1.png"> class=" wp-image-5691 landscape-med"
alt="Fig. 11. The code to steal signature certificate and keys. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/code-cert1.png"
width="546" height="326" /> Fig. 11. The code to steal
signature certificate and keys.[/caption]
The variable v1 is the phone number of the compromised Android phone,
while the Url.getSDPath() is the “temp” folder in the mounted storage:
[caption id="attachment_5692" align="alignnone"
width="533"] href="/content/dam/legacy/blog/2014/06/code-cert-path.png"> class=" wp-image-5692 landscape-med"
alt="Fig. 12. The location of the temporary folder that the malware app uses to collect signature certificate and keys. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/code-cert-path.png"
width="533" height="134" /> Fig. 12. The location of the
temporary folder that the malware app uses to collect signature
certificate and keys.[/caption]
The same zip file is named as “all.zip” to upload to a server and
also named as “{PHONE_NUMBER}_npki.zip” to send through Gmail as an attachment.
3. Bank Account Password Theft
[caption id="attachment_5693" align="alignnone"
width="545"] href="/content/dam/legacy/blog/2014/06/code-bank.png"> class=" wp-image-5693 portrait-med"
alt="Fig. 13. The code to steal personal bank account and password. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/code-bank.png"
width="545" height="600" /> Fig. 13. The code to steal
personal bank account and password.[/caption]
Network Traffic
We have intercepted the network traffic of the malicious app in the
href="http://www.fireeye.com/products-and-solutions/mobile-security.html">FireEye
Mobile Threat Prevention (MTP) Platform to verify the malicious
activities we found in the code above.
1. SMS Message Transmission
Because the destination, including the email address and the password
is stored in a cached file on the phone, we have replaced it with a
testing email account and redirected a testing SMS to the newly
created email address to simulate the scenario of receiving SMS in the
MTP platform. Here is an example of the SMS messages that we have
intercepted from the testing email account:
[caption id="attachment_5694" align="alignnone"
width="541"] href="/content/dam/legacy/blog/2014/06/result-sms.png"> class=" wp-image-5694 landscape-med"
alt="Fig. 14. The testing email and SMS we intercepted in the FireEye MTP platform. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/result-sms.png"
width="541" height="248" /> Fig. 14. The testing email and SMS
we intercepted in the FireEye MTP platform.[/caption]
The time stamp shows the email address received the content (at 9:39
PM) of the victim’s incoming SMS (at 9:38 PM) within 1 minute.
2. Signature Certificate and Key Transmission
We captured the PCap information in the FireEye MTP platform. The
PCap shows that the “all.zip” is uploaded to domain “dhfjhewjhsldie.xicp.net”.
[caption id="attachment_5695" align="alignnone"
width="557"] href="/content/dam/legacy/blog/2014/06/result-cert-pcap.png"> class=" wp-image-5695 landscape-med"
alt="Fig. 15. The PCap of the signature certificate and keys. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/result-cert-pcap.png"
width="557" height="205" /> Fig. 15. The PCap of the signature
certificate and keys.[/caption]
The same file is renamed to {PHONE_NUMBER}_npki.zip and sent as Gmail
attachment using SSL configuration. The picture below shows the
signature certificate file and signature primary key after unzipping
from the attachment that the malware app leaks to the SMTP server.
[caption id="attachment_5696" align="alignnone"
width="554"] href="/content/dam/legacy/blog/2014/06/result-cert-zip.png"> class=" wp-image-5696 landscape-med"
alt="Fig. 16. The content of the signature certificate and keys. "
src="https://www.fireeye.com/content/dam/legacy/blog/2014/06/result-cert-zip.png"
width="554" height="266" /> Fig. 16. The content of the
signature certificate and keys.[/caption]
3. Bank Account Password Transmission
We have found email evidence containing victims’ bank accounts and
passwords and worked with Google’s Gmail team to take down hacker’s
email accounts.
Source:
What are you doing? – DSEncrypt Malware
