Analysis of IBanking malware

The bad guys are now increasing their attack on mobile. A malware toolkit called IBanking is being sold up to US$5,000 in underground. Last February, the source code was leaked and following this is an uptick of occurrence of this malware in the wild. You can read the full story in Symantec blog post.

A number of samples were submitted to contagio and with my reversing skill and curiosity kicking in, I analyzed one of the sample.

Filename: 1F68ADDF38F63FE821B237BC7BAABB3D_IBanking_Chase.apk

When you first start the app, it will force itself to be installed as a device administrator so that even if you cancelled, it will re-launch the screen where it asks the user again if you want to install it as administrator. I am not sure how it was programmatically done. 

Installing this app as administrator enables the app to wipe your data and lock your phone.

This malware disguises itself as an anti-virus program but it just fakes the scan and do some nasty things.

Command and Control

This bot can communicate and accept commands from a web server and a phone number. The following are the CnC servers for this malware.

• myredskins.net
• mynamesmith.com
• +79067075145
• +790670751454

The servers and numbers above are from Russia.

The CnC web servers are defined in res/values/arrays.xml

It iterates to the list of its CnC web servers and check if they are active via http POST to:

• {domain}/iBanking/sms/ping.php

If the server replied as expected,  it will POST the following information to {domain}/iBanking/sms/index.php

• bot_id (defined in strings.xml)
• telephone number
• iccid
• device model
• OS version
• IMEI
• control_number (this is the CnC phone number)

This bot can accept commands from its CnC via SMS or HTTP. It intercepts any incoming SMS  and checks the number.

Via http it reads command from:

• {domain}/iBanking/sms/sync.php

It is looking for the following command strings:

• sms start - tell the bot to start intercepting and reading SMS
• sms stop - tell the bot to stop intercepting and reading SMS
• call start  - forward calls to +79067075145
• call stop - stop call forwarding
• change num -  tell the bot to change the CnC phone number
• sms list - read SMS inbox and sent messages and POST to {domain}/iBanking/getList.php
• call list - read call history, e.g., INCOMING, OUTGOING and MISSED calls and POST to {domain}/iBanking/getList.php
• start record - start audio recording. The file is saved as {externaldir}/Android/obb/{dd-MM-yyyy_HH-mm-ss}.txt. The files are then sent to {domain}/iBanking/sendFile.php
• stop record -   stop recording.
• sendSMS  - send intercepted SMS to the CnC phone number.
• contact list - get contact list
• wipe data - wipe data if device administrator is enabled.
• ping - check if the CnC server is alive

Looking at how this piece of malware is capable of, it was quite scary seeing those features packed in a single malware. And it is not far fetched to see malwares soon with more powerful features. It is still advisable for users to always be smart and watchful of things they visit and install into their system. 

Debugging apk files using Netbeans

Debugging apk files using Netbeans

As of this writing, there have been limited real time debugging methods for android apk applications.

This tutorial will talk about debugging android applications step-by-step.

Tools Needed:

1. Netbeans IDE 6.8. You can download it here. Restart your system after installation.

2. apktool.jar (version 1.4.1).  It will only work in this version. Download it here.

3. Signing tool.  You can download my signing tool here.

Step-by-step Instruction:

1. Decode your .apk file  using -d option of apktool. Example If you want to decode it in "out" directory type:

 java -jar apktool.jar d -d my.app.apk out

*Note that the out above is where the decompiled files will be saved. You can use any folder name here.

2.  Open the out folder and open AndroidManifest.xml. Add android:debuggable="true" attribute to <application> section in out/AndroidManifest.xml file.

3. Rebuild your apk.

java -jar apktool.jar b -d out my.app.to.debug.apk

4. Sign and install my.app.to.debug.apk.

5. Delete out/build and out/dist folder. This is because, netbeans will not allow you to create from existing project when those folders exists.

6. Run NetBeans, click "File" -> "New Project". Choose "Java"->"Java Project with Existing Sources". Click "Next".

7. Specify out as "Project Folder". Click "Next".

8. Add out/smali folder to the "Source Package Folder" list. Click "Next" and then "Finish".

9. Start the app on the device, run DDMS, find your application on a list and click it. Note port information in last column - it should be something like 86xx / 8700".

10. In Netbeans, click "Debug" -> "Attach Debugger" -> select "JPDA" and set "Port" to 8700 (or whatever you saw in previous step). Set your host to "localhost". Rest of fields should be ok, click "OK".

11. Debugging session should start: you will see some info in a log and debugging buttons will show up in top panel.

12. Set breakpoint.  You can't set breakpoint on lines starting with ".", ":" or "#". You must select line with some instruction

13. Trigger some action in application. If you run at breakpoint, then thread should stop and you will be able to debug step by step, watch variables, etc.

Other way of setting a breakpoint:

Notice that  you have to actually execute the app before you can attach the debugger. In most cases, we don't want this because some of the codes already executed. To get away with this, we can use the waitForDebugger() function.

1.  add the following smali code on the onCreate() method of the launcher activity.

   Insert

invoke-static {}, Landroid/os/Debug;->waitForDebugger()V

   After

 invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

  

 2.  Do steps from 3 to 11 from above. You will see just a black screen after you start the application on step 9; don't worry, it's normal. If Android proposes you to close the application because the application does not respond, reject the proposition. The application is frozen at the very beginning of execution, it is waiting for the debugger.

3. Set a breakpoint on the first instruction after invoke-static {}, Landroid/os/Debug;->waitForDebugger()V in theonCreate(...) method and continue execution. Your breakpoint will be hit and you will be able to debug the application step by step from the very beginning, watch variables, etc.