RedAlert

01. Introduction

An Android malware sample called "RedAlert" was found in the wild. The malware is known to collect data from infected phones and turns them to a remote controlled bots. You have to find out the address of the Command & Control (CC) server of the bots.

• Download the APK sample. (PW: infected)

• Extract the APK (apktool or jadx-gui)

• Analyze the resources

Your goal is

• to Extract the Android Package,

• Check the Android Permission (Check if it can intercept and write SMS messages)

• Find the CC server address (Protocol,IP, Port) in the resource files

APK File:

https://www.dropbox.com/s/hi5l559ad1cna2r/red_alert.zip?dl=0www.dropbox.com

02. Analysis

The permissions are stored in the manifest.xml file of the apk package. I’ll use the aapt tool to dump the permissions.

aapt dump permissions RedAlert.apk

Just a short check about the permissions looks very dangerous. The package can read and write sms messages:

Let's compare with the MobSF framework:

https://mobsf.live/mobsf.live

Now we can open the package in jadx-gui and check for strings that looks like an URL.

Maybe the CC Server URL will add a string from the list above. I’ll upload the apk file to virus total and get this graph: Note: We can see the string /stbi

Potential CC Server:

IP: 119.28.128.207 (CN) Protocol: http Port: 7878