RedAlert
Last updated
Last updated
An Android malware sample called "RedAlert" was found in the wild. The malware is known to collect data from infected phones and turns them to a remote controlled bots. You have to find out the address of the Command & Control (CC) server of the bots.
Download the APK sample. (PW: infected)
Extract the APK (apktool or jadx-gui)
Analyze the resources
Your goal is
to Extract the Android Package,
Check the Android Permission (Check if it can intercept and write SMS messages)
Find the CC server address (Protocol,IP, Port) in the resource files
APK File:
The permissions are stored in the manifest.xml file of the apk package. I’ll use the aapt tool to dump the permissions.
Just a short check about the permissions looks very dangerous. The package can read and write sms messages:
Let's compare with the MobSF framework:
Now we can open the package in jadx-gui and check for strings that looks like an URL.
Maybe the CC Server URL will add a string from the list above. I’ll upload the apk file to virus total and get this graph: Note: We can see the string /stbi
Potential CC Server:
IP: 119.28.128.207 (CN) Protocol: http Port: 7878
