It’s incredible how often our computers are in the scope of cyber attacks. Antivirus has become an indispensable shield to provide us with a more secure environment, since we are exposed to destructible malware and cyber attacks. Inside our pockets, we have computers so powerful, but much smaller, we must be equally attentive on our phones, because we can suffer equally damaging attacks, sometimes even worse, because they can store relevant information such as private conversations and important accounts.
[Task 2] An Unknown Land
Q1)What known as the first malware created to affect mobile devices?
Answer:Cabir
Press enter or click to view image in full size
Q2)What technology does this worm used to multiply?
Answer:BlueTooth
Press enter or click to view image in full size
Q3)What operating system did it infect?
Answer:Symbian
Press enter or click to view image in full size
Q4)What message did it show on the screen of the infected mobile phone?
Answer:Caribe
Press enter or click to view image in full size
[Task 3] Small size, a lot of destruction.
Q1)What is the format of the file?
Answer:.apk
Q2)Decode the name of the sample.
Answer:Malware
Q3)Which is the target platform?
Answer:Android
[Task 4] Digging Deeper
Q1)What does Avast-Mobile can tell us about this software?
Answer:Android:Metasploit-G [PUP]
Press enter or click to view image in full size
Q2:What program was used to create the malware?
Answer:Metasploit
Q3)What is the package name?
Answer:com.metasploit.stage
Q4)What is the SHA-1 signature?
Answer:74d442594acf11dc6e3492ffea5eb8956afd000d
Q5)What is the unique XML file?
Answer:AndroidManifest.xml
Q6)How many permissions are there inside?
Answer:22
Q7)Which permission allows the application to take pictures with the camera?
Answer:android.permission.CAMERA
Q8)What is the message left by the community?
Answer:THM{V1ru5-T0t4al-TWFsd2FyZS1BbmFseXNpcw}
Press enter or click to view image in full size
Get F4b1o22’s stories in your inbox
Join Medium for free to get updates from this writer.
[Task 5] MobSFing the sample.
Q1)What is the programming language used to create the program?
Answer:java
Q2)How many signatures does the package has?
Answer:1
Q3)Application is signed with v1 signature scheme, what is it vulnerable to on Android <7.0?
Answer:Janus
Press enter or click to view image in full size
Q4)What is the App name?
Answer:MainActivity
Q5)It looks like there is a function calling for the package manager, so it can see all the installed applications. What function is that?
Answer:b.getPackageManager
The flag “android:allowBackup” allows the user to backup application data via USB debugging. It is recommended that this be set as “False”, even if by default it is “True”.
Q2)After finding the sample on VirusTotal, what does the “Avast” anti-virus engine recognizes it as?
Answer: Android:Obfus-BM [Trj]
Press enter or click to view image in full size
Q3)With what we have, try to find out the name of the sample.
Answer:Pegasus
Q4)This became news for spying journalists, what year was that?
Answer:2017
Q5)What is the ID of the MITRE ATT&CK that is associated with our sample?
Answer:S0316
Press enter or click to view image in full size
Q6)What technique has the ability to exploit OS vulnerabilities to escalate privileges?
Answer:T1404
Press enter or click to view image in full size
Q7)There is a permission that when accepted, allows the application to access the list of accounts in the Accounts Service. What is the status shown by MobSF regarding this permission. (android.permission.GET.ACCOUNTS)
Answer:Dangerous
Press enter or click to view image in full size
Q8)What org.eclipse.paho.client file refers to properties of Portuguese from Brazil (pt-br)?
Q9)The malware has a special appeal for its safety and its internal components, reducing the risk of compromise. It has a functionality for its cryptographic operations with the feature of a random bit generation service. How can it be identified?
Answer:FCS_RBG_EXT.1.1
Press enter or click to view image in full size
[Task 7] Conclusion
It is normal to think that our mobile phones are harder to be infected, they have characteristics that makes the malware actions limited, as the Sandbox concept, and the fact that we never download things directly from the open internet.
