It’s Xmas time?! New BianLian samples to analyze thanks to @ni_fi_70 1 hour ago. Is that fresh enough? 😉 Let’s look into doc_hy_0906_obf.apk, with SHA256: 99e0053475ecd6a22b0e22b2441f0bf0a407b36be54e7d8220bb284c0bd494a8. Unpacking It is packed. Arg: my “JsonPacker” rule in APKiD doesn’t see it, I’ll have to fix that! Fortunately, students of mine wrote an unpacker…

Flutter is a framework able to build multi-platform apps (e.g. iOS and Android) from a single code base. The same source code is able to generate an iOS app, and/or an Android app, which is extremely convenient from a developer’s perspective. In the case of Flutter, the source code is…

A few days ago, a tweet reporting an Android malware caught my attention, because it was apparently found inside a health-related application named “Health Index Monitor”. A tour inside Cordova… The name of the package is com.monotonous.healthydiat, and the main activity is com.monotonous.healthydiat.MainActivity. …

You might want to read my prior articles on Android/BianLian first: unpacking, payload, fake server. There was a remaining point which was bugging me: how does the Android/BianLian bot know where to contact the C&C? Having worked on the samples for several days, I noticed they weren’t always heading to the…

To explain what a malware does, there’s no such good thing as showing in a video. But how can you do that safely? This is how I did it for Android/BianLian. Thanks to al1foobar for his help with iptables ;-) The bot Simply use an Android emulator. …

In the previous article, we discussed the packing mechanism of a Bian Lian sample, and how to unpack. This article reverse engineers the payload of the malware. It explains: The malicious components the bot implements. Those components can be seen as independent modules, and they are launched at the beginning…

This article explains how to unpack sample sha256 5b9049c392eaf83b12b98419f14ece1b00042592b003a17e4e6f0fb466281368 which was served from http://videofullizlesite9356[.]site/ApiServices-Files92752/Down at the beginning of January 2022 (see this tweet). The malware poses as a Video player and appears to be a member of the Bian Lian malware family (see former analysis 1 and 2). …

Pithus is a web front-end for several other tools: APKiD, MobSF, Quark, Androguard etc. I decided to try it against a random recent malware, and see how useful it could be to me. I selected a sample of the day (July 13, 2021) on VirusTotal. Note that, initially, I had…

This is an analysis of sample sha256 73fae61d9550186c9b68c0e3a0589f1faaa87f6a9dc8290f98aaf55db3a58350, which was uploaded to VirusTotal on July 1, 2021. It is detected as Android/Locker.CQ!tr. This malware appears as a test screen locker, with an explicit application icon “Virus”, and very few classes. Overview Most of Quark rules match with only little confidence. They…