APK Malware Analysis Using Red Teaming Approach
Hello, long time no write here. Now I will share my technical analysis about APK Malware using Red Teaming Approach. Actually I do this for a few months ago, but just in the mood to write today.
The APK was phising to Taspen Application, with MD5 Hash is 2b01c6cdbff422c59d403be828859aa2. The methodology I was use is static and dynamic analysis. For the static analysis I use MobSF, JADX, APKTool. For dynamic analysis I use Burpsuite, nmap, dirsearch, and manual analysis. I will jump to dynamic analysis directly so that this article is not too long.
The first, I try to intercept the application with Burpsuite, to analysis the behaviour and flow of the application.
From the image above, we can see that:
- The request was sent to the domain rpc[.]ynilx[.]top
- Request and response body was encrypted.
- Application was show the phising login form of the Taspen Application.
- No matter what I input on the login form, the application will accept and continue the input.
- Application need users to allow permission of accessibility and recording/casting the mobile phone.
Next step is too try dig dive with the detail. I try to analysis the Json Web Token (JWT) and Domain.
The JWT value have 3 parameter which is exp (expired), site_name (wich is using chinese language), and uid. The translate of the site name is lx indonesia-backstage 2.
For the domain analysis I just use VirusTotal (VT) and Censys, the VT show that the IP Public is 38.47.53.26 and have 4 dns replication:
- rpc[.]ynilx[.]top
- kef[.]ynilx[.]top
- ador[.]ynilx[.]top
- njailing[.]cn
While the location of the IP Public Server was on the Japan. The history of the DNS was in US, Singapore, and China.
Get Rizaldi Wahaz’s stories in your inbox
Join Medium for free to get updates from this writer.
Until this step, the temporary hypothesis that can be concluded is that the hacker is trying to hide identity, by using Chinese language in some application parameters, as well as using VPS from Japan, and actively changing DNS location.
I move from the mobile application and try to analysis with the web application domain. I found some interesting findings here.
I enumerate the domain and found that the domain have Simple Realtime Server (SRS) API. From what we have found at the beginning, the application asking for screen recording/casting permission is very related, it is possible that the hacker is monitoring the victim screen from here.
Furthermore, when I try to access the domain and try to login, the error notification show the Indonesian translate “kata sandi salah”, and on the Burpsuite show more of the Indonesian translate of the web apps menu. From this we can conclude that the Hacker is from local Indonesian.
The output results of the Nmap confirmed that the IP is open for port 8080 SRS/6.0.155 (Hang) and 30047 SRS Stream API Root.
During the analysis process, surprising vulnerability was discovered is an Unauthenticated SRS Console, which allows anyone to access the SRS console without authentication.
We can view information about the SRS server and who is currently connected to it. The image above shows nine clients actively connected to the hacker SRS server.
I tried and successful to viewing the victim mobile phone screen recording in real time, in this case using the RTMP Protocol without any authentication. I use the VLC player application by entering the IP, port, and ID Victim in the SRS hacker console.
This is very dangerous if the hacker can see the victim mobile phone activity in real time, the hacker can see the OTP Code sent to the victim and then authenticate to official application using the credentials the victim sent in the initial input form.
In general, the scenario used by hackers is:
- Hacker distribute phishing applications via WhatsApp/phishing websites.
- Phishing applications contain victim credential input.
- The application requests accessibility permissions and records/casts the screen victim.
- Hacker attempt to log in using the credentials entered by the victim.
- Hacker monitor the victim screen in real time to view the OTP Code.
- Hacker take the victim money stored in the application.
This scenario can be mass-duplicated by phishing government, private, and banking service applications such as tax, police, postal, banking, and so on.
Thats the analysis I can make. Stay safe everyone.
