RedAlert

01. Introduction

An Android malware sample called "RedAlert" was found in the wild. The malware is known to collect data from infected phones and turns them to a remote controlled bots. You have to find out the address of the Command & Control (CC) server of the bots.

  • Download the APK sample. (PW: infected)

  • Extract the APK (apktool or jadx-gui)

  • Analyze the resources

Your goal is

  • to Extract the Android Package,

  • Check the Android Permission (Check if it can intercept and write SMS messages)

  • Find the CC server address (Protocol,IP, Port) in the resource files

APK File:

02. Analysis

The permissions are stored in the manifest.xml file of the apk package. I’ll use the aapt tool to dump the permissions.

aapt dump permissions RedAlert.apk

Just a short check about the permissions looks very dangerous. The package can read and write sms messages:

Let's compare with the MobSF framework:

Now we can open the package in jadx-gui and check for strings that looks like an URL.

Maybe the CC Server URL will add a string from the list above. I’ll upload the apk file to virus total and get this graph: Note: We can see the string /stbi

Potential CC Server:

IP: 119.28.128.207 (CN) Protocol: http Port: 7878

PreviousAES Key decryptionNextBlackRoseLucy

Last updated