![Information
Analysis on Malware
Name com.google.android.providers.enhancedgooglesearch
Chinese Name
Original Name a.apk
URL Source
Collection
Source
System
Android
Platform
Format apk
MD5 Value BFBB58D0F8B487869393A0244AE71AFC
CRC32 Value C1C12A99
SHA1 Value 59EE114166CDBCDDB88B38299934021080053D86
Bytes
Malware Information
Name Trojan/Android.droiddg.a[rmt,sys]
CNCERT Name a.remote.droiddg.a
Chines Name
Other Names None
Original/Tied Firmware embedding
Threat type remote system](https://image.slidesharecdn.com/mobile-malware-industrial-viewslide-121105005331-phpapp01/75/Malware-in-Mobile-Platform-from-Panoramic-Industrial-View-7-2048.jpg)
![Form Control System(Adrd)
• Trojan/Android.Adrd.a[exp]
Issue the control command
and the malware trigger
command
Provide the data-accessing
address URL needed by
malware behavior
Provide the parameter data
needed by malware behavior
Provide updating service for
malware files](https://image.slidesharecdn.com/mobile-malware-industrial-viewslide-121105005331-phpapp01/75/Malware-in-Mobile-Platform-from-Panoramic-Industrial-View-14-2048.jpg)
Uploaded byAntiy Labs
Malware in Mobile Platform from Panoramic Industrial View
This document discusses malware threats on mobile platforms and provides 3 key points: 1. It describes new malware threats that disguise as news or other apps to install on mobile phones and steal private information like messages and contacts without the user's knowledge. 2. It analyzes the history of malware confrontation from the late 1980s to the present, noting the emergence of systematical confrontation using botnets in the 2000s and the current state of an underground industrial system. 3. It outlines solutions for analyzing and detecting mobile malware through techniques like disassembling code, behavior monitoring, and automatic comprehensive analysis to understand malware behavior and provide security.
More Related Content
Similar to Malware in Mobile Platform from Panoramic Industrial View
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Malware in Mobile Platform from Panoramic Industrial View
- 1. Malware in MobilePlatform from Panoramic Industrial View Antiy Labs
- 2. Contents introduction •a piece of “news” + a mobile phone phenomenon •new threat solution •Is everything under control? analysis •the history of confrontation conclusion •conclusion
- 3. INTRODUCTION: A PIECE OF“NEWS”+ A MOBILE PHONE
- 4. Talking From APiece of “News”
- 5.
- 6. Taking from aGrey Mobile Phone Customize Extra Expenses Extra Services Download Other Software 恶意行为 Network Flows Website Hits Steal Message, Privacy Contacts list
- 7. Information Analysis on Malware Name com.google.android.providers.enhancedgooglesearch Chinese Name Original Name a.apk URL Source Collection Source System Android Platform Format apk MD5 Value BFBB58D0F8B487869393A0244AE71AFC CRC32 Value C1C12A99 SHA1 Value 59EE114166CDBCDDB88B38299934021080053D86 Bytes Malware Information Name Trojan/Android.droiddg.a[rmt,sys] CNCERT Name a.remote.droiddg.a Chines Name Other Names None Original/Tied Firmware embedding Threat type remote system
- 8. A Truely FunnyStory A sexy E-market A grey Android mobile Genuine mobile Real E-market
- 9.
- 10. INTERPRETATIONS OF NEWTHREATS
- 11. Crossing the SystemPlatform(Zitmo) Android RIM OS Windows Zeus Zitmo Symbian account/ random password identifying code WinCE attacker Net Bank
- 12. Steal Message andContacts List (SW.Spyware) Propagation Means – Disguise as Tax Amount Calculating Software Package Calculating Procedure – Installation – Model as QQ Loginform to Lure Uses – Get the Account and Password of QQ and Send to Some Specific Mobile Phone Object system – Android Harm – Steal Message Contetns – The SW.Spyware.B Variant Can Even Monitor the Communication Record of User Damage Range – First version of Android virus Propagaton Time – July, 2010
- 13. Spycall (Nickispy) • Spycalland send back • Disguise as Google+ in the First Time 2011/09/17 第13页
- 14. Form Control System(Adrd) •Trojan/Android.Adrd.a[exp] Issue the control command and the malware trigger command Provide the data-accessing address URL needed by malware behavior Provide the parameter data needed by malware behavior Provide updating service for malware files
- 15. the interdisciplinary useof leak and social engineering 1. Replace normal application by means of Google application download bug 2. Consumers download bootleg applications which are actually malware, with 200 thousand victims. 3.Google clears out malware by remote upgrade interplay and provides security software 4.The malware attacker disguises as Google security software
- 16.
- 17. Traditional view Host SIS format APK PE ……… Malware Mobile malware Android Spreading System SymbOS media entrance Various Windows media Mobile
- 18. Major Spreading Approaches •Official • GPRS/3G market/network • Wi-Fi • Third-party market • PC shared network • Message/multimedia Internet User message installation download PC Inserting penetration ROM • Flash memory share • User Flash • USB communication • Vendor pre-setting up 第18页
- 19. Dalvik Disassembling: IDAPro 第19页
- 20. Static Analysis: ARMDisassembling 第20页
- 21. Static Analysis: JavaDecompilation 2011/09/20 第21页
- 22. Dynamic Analysis: SDKSimulator 第22页
- 23. Dynamic Analysis: BehaviorMonitor 第23页
- 24. Network Analysis 第24页
- 25. Automatic Analysis 第25页
- 26.
- 27.
- 28.
- 29.
- 30. System Simulation 第30页
- 31.
- 32.
- 33.
- 34.
- 35. ANALYSIS: THE HISTORY OFCONFRONTATION
- 36. Those Forgotten GreyFaces ？ CIH Melisa Sasser 1998 1999 2004
- 37. Those Forgotten RedAlert ？
- 38. A Cross-Platform Contrast 2001 2010
- 39.
- 40. Cross Platform-Mobile +PC Bimorphism SymbianUpdateSrv.exe 912812352001_3rd.sisx start and update new module 0xe61caca0.dat （jar） symbianDL.exe dlinstall.dat （sisx） Function disguising class files download module module install.dat20 （sisx） symbianStarter.exe symbianSrv.exe clearing module service-monitoring symbianChkServer.exe module heartbeat telecontrol module
- 41. The Confrontation HistorySince 1988 Industrial Confrontation Systematical Confrontation Normalized Confrontation
- 42. Notable Event andTypical Method of Normalized Confrontation • Bouncing Ball Virus • Pattern Matching Penetrated • Difficulty Promoted • Encrypted Virus • Direct Attack Mechanism • Metamorphic Virus • Disrupting the Wording Chain • Script Virus • Interfering Mechanism • Macro Virus • Normalized Confrontation
- 43. Normalized Confrontation Virus current database framework diverter Object obataining matching preprocessor box assessor disposer Solution
- 44.
- 45. Systematical confrontation (notableevent) The Emerge of P2P Zombie Network The Application of PKI System in Zombie Network Attack on VirusTotal by distributed DDos Shift from Client to Could Port
- 46. Industrial Confrontation (2005—Now) underground information industrial industrial system system
- 47. An Integral WholeSeen from Underground Economy Chain invade enterprise sale server steal secret invade server network games underground obtain money steal virtual industrial steal account launder currency player steal bank money account invade website massively steal network send rubbish e- exchange mail account compile malware steal virtual reject service spreading property attack incorporate forum spread charge spread Compile Zombie mobile tying spread network malware mobile SP expense malware code deducting
- 48. Industrial Chain: Complexand Interminable app store Software personal content supplier supplier enterprise security application vendors sale service software service private official supplier service after-sale baseband spare- manufactu sale solution OS chip parts ring approach Qualcomm TechFaith ARM Symbian、WM、 genuine product TI DaTang Memory Macos、android、 grey product …… Battery palm…… custom and tie 48
- 49. Summary Malware has developedand broke through the traditional single concept of program code. It has penetrated into the whole system of society, politics, economy and life. It is impossible to resist malware effectively only relying on anti-virus vendors. The battle against malware requires the management and resistance of the whole social system. Anti-virus men of all countries, unite! Thank you! seak@antiy.com