"Dark lurks"

"Dark lurks"

Recently, Baidu security lab has discovered a new "Dark lurker" mobile phone virus. The virus is attached to many wallpaper and game applications. Up to now, more than 10 thousand applications have been infected with the virus, and more than 30 million users have been infected.
 
The malicious behavior of the virus is as follows:
1. the backend uses system vulnerabilities to obtain temporary Root permissions.
2. Install the sysphones.apk malicious program as the system software and install the Root backdoor program zy to the/system/bin directory.
3. SysPhones.apk silently downloads, installs, and promotes applications based on server instructions, and installs and promotes applications as System Software Based on commands, so that they cannot be uninstalled.
4. other unknown potential malicious behaviors.
 
 
I. How to obtain temporary Root Using System Vulnerabilities
 
The mobile phone virus uses the well-known Root tool FramaRoot vulnerability to obtain temporary Root permissions.
Http://forum.xda-developers.com/apps/framaroot/root-framaroot-one-click-apk-to-root-t2130276)
FramaRoot integrates the code used by the Root of many Android system vulnerabilities. Currently, it can provide Root capabilities for nearly 400 Android devices. The list of supported devices is as follows:
Http://forum.xda-developers.com/apps/framaroot/framaroot-supported-devices-t2722980)
The key functions of FramaRoot are integrated in the libframalib. so library. The so Library provides two interfaces for the JAVA layer to call:
Check interface: detects device vulnerabilities and returns the vulnerability list.
Launch interface: Execute the vulnerability to obtain the Root user by using the code based on the passed vulnerability name.
Install the superuser.apk and su files attached to the so to the system directory after root1.
The virus cleverly utilizes FramaRoot's working mechanism and builds a malicious FakeFramaRoot by replacing key data. As shown in:
 

 

Ghost is a system application, and zy is installed to the/system/bindirectory. zyas is the background program, and sysphones.apk is capable of executing commands by the Root user.
 
 
Ii. Security Detection and Reverse Analysis Methods
 
According to the detected data, the app with this trojan appeared for the first time in March. It has been detected for nine months. The virus uses the following methods to conceal malicious behaviors:
1. Reverse Analysis is blocked through anti-debugging technology, native key malicious code, encryption of key code data, and encryption of network communication data.
2. Download and dynamically load key malicious code from the cloud.
3. malicious behaviors are triggered dynamically on the cloud and controllable.
 
 
Iii. Working Principles of dark lurks
 
After complete reverse analysis of the Code, the operating principle of the entire mobile Trojan is shown in:
 

 
 
Iv. Malicious Code Analysis
 
The malicious code embedded in the application consists of two parts:
1. com. android. luahc [Java]
This module uploads device information to the instruction server and downloads the malicious code FakeFramaRoot. so library based on the instructions returned by the instruction server.
2. libluahc. so [Native]
Call the fakeframaroot.solibrary to obtain the token rootpermission and install sysphones.apk and zy.
 
This trojan will not be triggered immediately after installation. It will only trigger malicious behavior after the device restarts the next time. All key strings, such as URLs and paths, are encrypted and stored in byte arrays. This can prevent antivirus software from being killed.
 

 
All network communication data is encrypted. The following is the network interaction data of the com. android. luahc [Java] Request command server to obtain the FakeFramaRoot. so database:
Request the server to obtain the FakeFramaRoot command:
 

 
The server returns the following data:
 

 
After decryption, the server returns the following data:

Http: // 106.187.44.144/qwe

 
After obtaining com. android. luahc [Java], download the file and save it as libframalib. so1, and libframalib. so1 as the compressed file. decompress the file and obtain the libframalib. so file:
 

 
Com. android. luahc [Java] indirectly loads the FakeFramaroot. so library function by calling libluahc. so.
 
Libluahc. so is attached to the application installation package with the assets/tenatt file. It is released to the file directory during runtime and loaded by the com. android. luahc [Java] layer. Functions:
1. In JNI_OnLoad, call ptrace to perform anti-debugging:
 

 
2. Load the fakeframaroot. so library and call the check interface to obtain the vulnerability list.
 

 
3. Load the fakeframaroot. so library and call the launch interface for Root
 

 
Fakeframaroot.soafter obtaining the deny rootpermission, install sysphones.apk as the system application, install zy to the/system/bindirectory, and zyas the background program. Then, use sysphones.apk as the Root user to execute commands.
 
The malicious program code structure of SysPhones.apk is as follows:
 

 
SysPhones.apk is automatically started after it is started. The background requests the server to obtain the command, and silently download and install the promotion application according to the command.
The request data is as follows:
 

 
The decryption server returns the following results:
Org. zxl. appstats 4.0 http://dl.appfreestore.com/1104/AppStats.apk 1 0
 
The returned command format is:
[Package name] [version] [] [whether to install as a system application (1: System Application)] [retain]
 
The code for decrypting and parsing the returned results is as follows:
 

 
Build a Command Script according to the command:
 

 
Use libSysPhones. so of sysphones.apk to obtain the password parameter required to call the zy executable file:
 

 
Call the zy program to execute the build Command Script:
 

 
Zy is used as the Root backdoor in the system directory. It receives external commands and runs the incoming shell commands as the Root.
The call format is:
Zy password command
Password: obtained through libSysPhones. so in sysphones.apk. This ensures that the backdoor is only used by malicious developers.