spicy security research
About a month or two ago, someone asked me to analyze some obfuscated Android malware. Recently, I finally had a chance to take a look. I ended up using dex-oracle along with some tricks to partially deobfuscate it. In this post, I’m going to explain the tricks and the overall process I used. This post will be useful if you deal with a lot of obfuscated Android apps. The main problem was…
This gif perfectly describe me attempting to connect debuggers to a kext using all the “simple” instructions on the internet. Recently I had far too much time on my hands and a Kext binary which seemed to pique my interest. After spending a bit of time analyzing the binary in IDA Pro, I wanted to prove out some theories I had by debugging it. A while back I had set up MacOS to be running as a…
Table of Contents Soapbox Prelude The Story Analysis APK Content Signing Certificate Android Manifest String Encryption Decrypting the Strings Features Overview Data Exfiltration Is it HackingTeam? Conclusion Appendix Yara Rule Samples Captured C2 Interactions RequestActionsToExecute - Request RequestActionsToExecute - Response AckRequestedActions - Request AckRequestedActions - Response…
GO binaries are weird, or at least, that is where this all started out. While delving into some Linux malware named Rex , I came to the realization that I might need to understand more than I wanted to. Just the prior week I had been reversing Linux Lady which was also written in GO, however it was not a stripped binary so it was pretty easy. Clearly the binary was rather large, many extra methods…
Android apps are much easier to modify than those of traditional desktop operating systems like Windows or Linux, and there’s primarily only one way to modify Android apps after they have been compiled from source: dexlib . Even if you’re actually using Apktool or Smali , they are both using dexlib under the hood. Actually, Apktool uses Smali, and Smali and dexlib are part of the same project. Why…
We recently gave a presentation at HITCON 2016 called Android Compiler Fingerprinting where in we released a tool called: APKiD . It’s basically PEiD for Android – it detects several compilers, obfuscators, and packers and we’re adding to it whenever we find new stuff. You’re welcome to submit your rules also.