Motivation Main links How to submit a sample: check admissibility, upload or insert Search or Refine your search FAQ: when will my sample get reviewed, I am trustworthy, can my sample be automatically accepted please?, can I modify an entry? I can’t find this feature, my new sample doesn’t show…

With students of mine, we built a static unpacker (short of public name, I named it “JsonPacker” in APKiD). Unfortunately, the static unpacker doesn’t work for the sample and the students are in for a quick patch before their defense in a few days. Lol. …

I am looking into a new sample of Android/Joker, reported on June 19, 2022 by @ReBensk: afeb6efad25ed7bf1bc183c19ab5b59ccf799d46e620a5d1257d32669bedff6f Android/Joker is known for using many payloads: a first payload loads another payload, which loads another one etc. Matryoshka dolls-style 😁. See an analysis of a previous Joker sample. This sample uses many…

It’s Xmas time?! New BianLian samples to analyze thanks to @ni_fi_70 1 hour ago. Is that fresh enough? 😉 Let’s look into doc_hy_0906_obf.apk, with SHA256: 99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8. Unpacking It is packed. Arg: my “JsonPacker” rule in APKiD doesn’t see it, I’ll have to fix that! Fortunately, students of mine wrote an unpacker…

Flutter is a framework able to build multi-platform apps (e.g. iOS and Android) from a single code base. The same source code is able to generate an iOS app, and/or an Android app, which is extremely convenient from a developer’s perspective. In the case of Flutter, the source code is…

A few days ago, a tweet reporting an Android malware caught my attention, because it was apparently found inside a health-related application named “Health Index Monitor”. A tour inside Cordova… The name of the package is com.monotonous.healthydiat, and the main activity is com.monotonous.healthydiat.MainActivity. Its code is extremely simple, and we quickly recognize the…

You might want to read my prior articles on Android/BianLian first: unpacking, payload, fake server. There was a remaining point which was bugging me: how does the Android/BianLian bot know where to contact the C&C? Having worked on the samples for several days, I noticed they weren’t always heading to the…

To explain what a malware does, there’s no such good thing as showing in a video. But how can you do that safely? This is how I did it for Android/BianLian. Thanks to al1foobar for his help with iptables ;-) The bot Simply use an Android emulator. …

In the previous article, we discussed the packing mechanism of a Bian Lian sample, and how to unpack. This article reverse engineers the payload of the malware. It explains: The malicious components the bot implements. Those components can be seen as independent modules, and they are launched at the beginning…