diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md index 4e0b627567c..898f8c42703 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md @@ -1,7 +1,5 @@ # Android Malware Post-Exploitation -{{#include ../../banners/hacktricks-training.md}} - This page collects Android malware behavior that happens after installation or execution: payload staging, persistence, C2, Accessibility-driven control, overlays, SMS/OTP abuse, fraud automation, and botnet tasking. Keep Android app pentesting methodology focused on testing legitimate apps, and use this page when reversing malicious Android samples or documenting post-install tradecraft. ## C2-Gated Permission Abuse and Background Collection @@ -51,13 +49,15 @@ Triage ideas: - full routes present but no forwarding path from the TUN reader back to a socket / output stream - setup-themed notifications while only a few apps retain connectivity +A narrower variant sends **only** Google Play Store traffic into the blackhole by calling `addAllowedApplication("com.android.vending")`. One observed dropper installed IPv4 and IPv6 routes, discarded the resulting TUN packets for 240 seconds, and polled the unknown-source permission every 800 ms so sideloading resumed immediately after approval.[[19]](#references) Hunt for `addAllowedApplication("com.android.vending")`, a `240000` teardown timer, and `PackageInstaller` calls in the same path. + ### Facade UI and Collection The app may show harmless views such as an SMS viewer or gallery picker while background collection starts: - IMEI / IMSI, phone number - Full `ContactsContract` dump as JSON -- JPEG/PNG from `/sdcard/DCIM`, often compressed with [Luban](https://github.com/Curzibn/Luban) to reduce size[[5]](#references) +- JPEG/PNG from `/sdcard/DCIM`, often compressed with [Luban](https://github.com/Curzibn/Luban) to reduce size.[[5]](#references) - Optional SMS content from `content://sms` Payloads are commonly batch-zipped and sent via HTTP endpoints such as `/upload.php`. @@ -144,6 +144,28 @@ Triage ideas: - `Application.attachBaseContext` doing large asset reads before any UI is created - fake media/font assets later passed into `ZipInputStream`, `DexClassLoader`, or custom RC4 helpers - reflection on `pathList`, `dexElements`, `ContextImpl`, or `LoadedApk` close to asset decryption +- compare every activity, service, and receiver declared in `AndroidManifest.xml` against **all** packaged `classes*.dex` files; components that resolve only after an asset is decrypted are strong staged-loader indicators.[[15]](#references)[[21]](#references) + +### Asset-to-`PackageInstaller` staging and nested child payloads + +Another useful evasion pattern is to hide stage 2 inside `assets/` and **stream it directly into a `PackageInstaller` session** instead of first dropping a plainly named APK in shared storage. In the Octagon chain, the installed child then generated a JAR under its private `app_walk` directory and dynamically loaded the final module.[[15]](#references)[[21]](#references) + +Hunting ideas: +- correlate `ACTION_MANAGE_UNKNOWN_APP_SOURCES` / `REQUEST_INSTALL_PACKAGES` with `PackageInstaller.createSession` -> `openWrite` -> `fsync` -> `commit` +- watch for the parent package stopping a temporary service (often VPN / overlay / lure UI) immediately after install, then launching the new package +- inspect `PACKAGE_ADDED` / `PACKAGE_REPLACED` receivers, private `app_*` directories, and follow-on `DexClassLoader` activity in the child app + +### `AccountManager` + Sync Adapter persistence + +A less common but very useful Android persistence primitive is to register a **fake account** and attach a **Sync Adapter** to it. Octagon registered the `OctagonPanel` account, scheduled synchronization every 30 minutes, and could request an immediate synchronization to resume activity or reconnect to C2.[[21]](#references) + +What to look for: +- authenticator XML/resources plus code calling `AccountManager.addAccountExplicitly` +- a sync adapter service with `android.content.SyncAdapter` metadata +- suspicious sync intervals (for example every 30 minutes) or forced immediate sync right after connectivity returns +- boot receivers / WorkManager jobs whose only purpose is to re-register the account or reschedule sync + +This is especially useful in samples that already store queue/state locally (SQLite + SharedPreferences): periodic sync becomes the exfil/reconnect trigger for offline-collected SMS, credential captures, contacts, or phishing results. ### Anti-analysis kill-switch @@ -589,7 +611,7 @@ Note: Many DevicePolicyManager controls require Device Owner/Profile Owner on re ### NFC relay orchestration (NFSkate) Stage-3 can install and launch an external NFC-relay module (e.g., NFSkate) and even hand it an HTML template to guide the victim during the relay. This enables contactless card-present cash-out alongside online ATS.[[12]](#references) -Background: [NFSkate NFC relay](https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay). +Background: [NFSkate NFC relay](https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay).[[12]](#references) ### Operator command set (sample) - UI/state: `txt_screen`, `screen_live`, `display`, `record` @@ -860,6 +882,57 @@ struct Header { - Once verified, the bot sends a `MsgType=0` body carrying the operator-defined **group string** (e.g. `android-postboot-rt`). If the group is enabled, the C2 responds with `MsgType=2 (confirm)`, after which tasking (MsgType 5–12) begins. - Supported verbs include SOCKS-style TCP/UDP proxying (residential proxy monetization), reverse shell / single command exec, file read/write, and **Mirai-compatible DDoSBody** payloads (same `AtkType`, `Duration`, `Targets[]`, `Flags[]` layout). + +## Copybara-style banker / RAT tradecraft: parser differentials and decoy overlays + +### Hostile APK/ZIP parser differentials + +Some droppers intentionally build APKs that Android or tolerant ZIP readers can still process while common analysis tooling disagrees about the file layout.[[19]](#references) + +Interesting anti-analysis shapes: +- **local-header vs central-directory mismatches** (for example different compression methods for the same entry) +- **oversized ZIP extra fields** and random Unicode path components +- **extremely long asset names** used to hide the real payload near the end of a path that desktop tools fail to materialize +- **file-versus-directory collisions** below names normally treated as files, such as `classes.dex/`, `AndroidManifest.xml/`, or `resources.arsc/` + +Practical workflow: + +```bash +zipinfo -v sample.apk +7z l sample.apk +bsdtar -tf sample.apk +python -m zipfile -l sample.apk +jadx sample.apk -d out-jadx +apktool d sample.apk -o out-apktool +``` + +If these tools produce different entry lists, or one sees `classes.dex` while another sees children under `classes.dex/`, treat the APK as **parser-differential anti-analysis** rather than a broken download. [apkInspector](https://github.com/erev0s/apkInspector/) can compare local headers with the central directory and flag path collisions and other tampering indicators.[[20]](#references) + +In the analyzed Copybara chain, the outer APK concealed an RC4-encrypted JAR at the tail of a 2,441-byte asset path. Decrypting that JAR exposed a DEX loader that located and installed the final `assets/base.apk` payload.[[19]](#references) This is a useful extension of the earlier `attachBaseContext()` triage: inspect the tail of abnormally long assets even when the visible application code appears to contain only lure UI and permission handling. + +### Context hiding instead of biometric bypass + +Accessibility bankers do not always need to break biometric crypto. A full-screen branded loading page or a generic utility **WebView decoy** can hide the real app while Accessibility performs taps underneath. If the victim is tricked into approving a genuine biometric / system prompt whose context is concealed, the attacker gets authorization **without** bypassing the biometric primitive itself.[[19]](#references) + +Operational clues: +- locale-driven HTML decoys such as `pg-en.html`, `pg-it.html`, ... loaded full-screen in a `WebView` +- hard-coded battery / temperature / RAM values used only to make the decoy look alive +- `TYPE_ACCESSIBILITY_OVERLAY` or opaque activity screens shown while `dispatchGesture`, `ACTION_SET_TEXT`, `performGlobalAction`, or notification suppression runs in parallel +- strings / structures indicating **server-defined overlays**, e.g. an `inj` object containing `package` + template filename so new target apps can be added without rebuilding the APK + +### Split MQTT control/media channels for Accessibility RATs + +One analyzed Copybara payload used TCP port `52997` for its primary MQTT channel and port `52998` for camera and MediaProjection traffic. It subscribed to `commands_FromPC`, registered through `RegisterMyDevice`, and substituted the Android ID into the registration payload.[[19]](#references) + +A practical pattern to hunt for: +- MQTT topic such as `commands_FromPC` for serialized commands +- separate registration topic such as `RegisterMyDevice` +- one port/channel for command dispatch and a second port/channel for MediaProjection or camera traffic +- Android ID or a similarly stable device identifier substituted into the registration payload before subscription/publish + +Separating these channels can keep UI automation responsive while heavier screen or camera data uses a different socket or QoS profile. + + ## References - [1] [Premium Deception: Uncovering a Global Android Carrier Billing Fraud Campaign](https://zimperium.com/blog/premium-deception-uncovering-a-global-android-carrier-billing-fraud-campaign) @@ -880,5 +953,8 @@ struct Header { - [16] [Rokarolla : Android Banker with Complete Device Takeover Capabilities](https://zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities) - [17] [Zimperium IOC – Rokarolla commands](https://github.com/Zimperium/IOC/blob/master/2026-06-Rokarolla/commands.md) - [18] [Kimwolf Android TV Botnet: ENS-Based C2 Evasion, TLS+ECDSA C2 Protocol, and Large-Scale Proxy/DDoS Operations](https://blog.xlab.qianxin.com/kimwolf-botnet-en/) +- [19] [Inside an N26 Impersonation Campaign: From Vishing and Fake Control 1.0 to the Copybara Android RAT](https://d3lab.net/inside-an-n26-impersonation-campaign-from-vishing-and-fake-control-1-0-to-the-copybara-android-rat) +- [20] [apkInspector](https://github.com/erev0s/apkInspector/) +- [21] [Octagon: Technical Analysis of a Fake Bahrain Civil Defense Application](https://labs.k7computing.com/index.php/octagon-technical-analysis-of-a-fake-bahrain-civil-defense-application/) {{#include ../../banners/hacktricks-training.md}}