The document discusses various techniques for analyzing and modifying Android APK files, including decompiling them using ApkTool and Dex2Jar, modifying the Smali code, and repacking the APK. It provides examples of Java code and corresponding Smali op-codes for displaying an alert dialog. It also discusses potential malicious behaviors of the Geinimi Android trojan and lists several malicious domain names and apps.

1. 恶意软件
Apk Explorer Series .2
1

2. 恶意软件@Android
2

3. N多做的
Nduo
Nduo Apk
3

4. 如何实现
.apk .dex .smali new.apk
• Unzip • Decompile • Modify • Repack
• ApkTool[1] • Smali[4] • ApkTool
• Dex2Jar[2]
4

5. Wet feet
AlertDialog Java Code
AlertDialog alertDialog = new
AlertDialog.Builder(this).create();
alertDialog.setTitle("LALALA");
alertDialog.setMessage("You should see me!!!!!!!");
alertDialog.show();
5

6. Wet feet cont.
AlertDialog Op-code
new-instance v1, Landroid/app/AlertDialog$Builder;
new-instance
#v1=(UninitRef);
v1, Landroid/app/AlertDialog$Builder;
#v1=(UninitRef);
invoke-direct {v1, p0}, Landroid/app/AlertDialog$Builder;-
invoke-direct {v1, p0}, Landroid/app/AlertDialog$Builder;-
><init>(Landroid/content/Context;)V
><init>(Landroid/content/Context;)V
#v1=(Reference);
#v1=(Reference);
invoke-virtual Landroid/app/AlertDialog$Builder;->create()Landroid/app/AlertDialog;
invoke-virtual {v1}, {v1}, Landroid/app/AlertDialog$Builder;-
move-result-object v0
>create()Landroid/app/AlertDialog;
move-result-object v0
.local v0, alertDialog:Landroid/app/AlertDialog;
.local v0, alertDialog:Landroid/app/AlertDialog;
#v0=(Reference);
#v0=(Reference);
const-string "LALALA"
const-string v1, v1, "LALALA"
invoke-virtual {v0, v1}, Landroid/app/AlertDialog;->setTitle(Ljava/lang/CharSequence;)V
invoke-virtual {v0, v1}, Landroid/app/AlertDialog;->setTitle(Ljava/lang/CharSequence;)V
const-string "You should see me!!!!!!!"see me!!!!!!!"
const-string v1, v1, "You should
invoke-virtual {v0, v1}, Landroid/app/AlertDialog;->setMessage(Ljava/lang/CharSequence;)V
invoke-virtual {v0, v1}, Landroid/app/AlertDialog;-
>setMessage(Ljava/lang/CharSequence;)V
invoke-virtual {v0}, Landroid/app/AlertDialog;->show()V
invoke-virtual {v0}, Landroid/app/AlertDialog;->show()V
6

7. Wet feet cont.
.method public onCreate(Landroid/os/Bundle;)V Yingyonghui Java code
.locals 12
.parameter "savedInstanceState" SplashActivity.java
.prologue
const/16 v11, 0x400
#v11=(PosShort);
AlertDialog Op-code
const/4 v10, 0x0
#v10=(Null);
const/4 v9, 0x1
#v9=(One);
invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V
7

8. Wet feet cont.
HideFile Java code
HideFiles.java
a.a("http://market.nduoa.com/update/nDuoaMarket.apk", str2);
8

9. Geinimi [6]
9

10. Geinimi cont.
Board Product
Brand PTID www.widifu.com
CPID SALESID
CPU ABI SDK version www.udaore.com
Geinimi
Device Shell www.frijd.com
DID SIM Country ISO
Display SIM Operator
www.islpast.com
Fingerprint SIM Operator www.piajesj.com
Host Name www.qoewsl.com
Line1 Number SIM Serial Number
Access the user's geo-location based on
Manufacturer SIM State www.weolir.com
coordinates given by
Model the GPS Software Version www.uisoa.com
Send or receive Network Country Subscriber ID
SMS messages www.riusdu.com
ISO Tags
Access the user's mailbox
Network Operator Time www.aiucr.com
Read and modify the user's phonebook contacts
Network Operator Type
Read and modify the user's browsing history
Name User 117.135.134.185
Network Type memorymail Number
Check running processes in Voice 180.168.68.34
Phone Type
Terminate legitimate running process in the device
Install shortcuts
Perform web queries
Change the wallpaper of the device
10

11. PJApp 泡椒[3][5]
"content://browser/bookmarks"
MEEGO91.COM
com.uc.browser
SEND ALL Bookmarks
com.tencent.mtt
IMEI / SIM / IMSI / ICCID
com.opera.mini.android
Pdus
ADD
mobi.mgeek.TunnyBrowser
……
android.paojiao.cn
com.skyfire.browser
ct2.paojiao.cn
com.kolbysoft.steel
g3g3.cn
Default Browser
com.android.browser
渠道激活
11

12. MEEGO91.COM
Registrant:
nduo demi
nanchang jiangxi sicA501
nanchang, jiangxi 444001
China
Registered through: GoDaddy.com
Created on: 05-Sep-10
Expires on: 05-Sep-11
Administrative Contact:
demi, nduo wangluoxing@163.com
nanchang jiangxi sicA501
nanchang, jiangxi 444001
China
+86.861363345678
12

13. Reference
1. http://code.google.com/p/android-apktool/
2. http://code.google.com/p/dex2jar/
3. http://www.itnews.tk/archives/4761
4. http://code.google.com/p/smali/
5. http://globalthreatcenter.com/?cat=18
6. http://blog.mylookout.com/_media/Geinimi_Trojan
_Teardown.pdf
13

14. Question ?
14