Risk code loader Analysis

Risk code loader Analysis
Baidu security lab recently found several risk programs on the official Google Play market. These programs can load risk code, promote other risk applications, and activate the Device Manager code to prevent uninstallation, the background collects user privacy information. Users also need to be cautious with the official Google Play market applications.

 

Behavior Analysis:

 

After the program starts, it dynamically loads the downloaded code package from the network, downloads the configuration file to the local parsing, pushes the risk advertisement, and collects user information to the server. Here is code disassembly:

 

Code structure:

 

 

After the program runs, the hacker downloads a file named thumb.apk from the network to the/data/{package name}/cache/directory. In one step, you can see that thumb.apk contains risky advertisements such as leadbolt:

 

 

Figure 1 download thumb.apk to the cache directory

 

 

Figure 2 code structure contained in thumb.apk

 

 

This advertisement can collect user information and frequently push the advertisement to the notification bar:

 

 

Figure 3 push notification bar message

Figure 4 collect user information

 

 

Request the Device Manager code to prevent normal uninstallation: