How I Removed Android Malware in Minutes
Malware Analysis of Simple Android Malware
Today we will analyze a simple android malware named “onlyfans.exe”.
Intro
This application will block the device and you cannot even perform any type of action.
Use adb
First install adb (android debugger) in your windows system for android device connection.
Run Simulator
We will on Android simulator named LDPlayer in windows system.
First, we execute the malware directly. with one click only
As soon as it runs, the phone screen gets locked, and the device becomes completely unusable. You cannot press anything, open settings, or uninstall any application through the UI. For this demonstration, root permission is enabled in the LDPlayer settings to ensure safe and controlled analysis.
Get CyberMonk’s stories in your inbox
Join Medium for free to get updates from this writer.
Now we will start adb server and get the shell by commands
by top command we can see an application is running in machine phone, named “com.termuxhackers.id”
top
We will confirm this by going to “/data/data” which is the private application data directory in Android. Every installed application gets its own folder here, named after its package name.
we will execute “ls -la” command and based on timing we can also check which package owned by application/malware.
to uninstall application package from android. use below command
pm uninstall com.termuxhackers.id
And like this how you can uninstall application package itself, and remove malware.
And our phone is now unlocked.. 👍
You can also Decompiler tool named “APK Easy Tool” for android malware. and have more information about APK file, which will create folder on Current directory of this tool for analysis of APK, but as of now I don’t have that much knowledge of structure of APK file I will shortly give update on this.
Shortly I will also start blogging about Another techniques for android malware and also for Malware Development.. So stay tuned and give a follow.
