In this video, we will analyze a malware application called Colford Underscore Spying, Max.
You can go to this Eurail here on gets Huub.
Download the application, unzip it, use the password infected, as you can see on their page, and
then decoded and decompiled it.
So of that, as you can see, these are the resources of the application.
And this is decompiled file.
Now, I'll go here.
Open Android manifest as this is the appropriate place to start the static malware analysis.
As you can see, lots of dangerous permissions that has to do with call logs as Hamas contacts, external
storage, audio, Internet and camera.
A lot of those are declared by the application.
It means that obviously this is a malicious application.
If you scroll down, you'll see that there are three services being declared by the application.
So the services are really a very good place for the author of malware in order to hide some malicious
activity.
So let's start by copying the service here.
Let's see, what is this service doing?
I'll minimize that and go to the jaw file.
Let me open J.T. Gooey first.
And then move the file here.
I'll close that for the time and will go to the search function.
Let me open that.
So as you can see, this glass is cleared here.
Obviously, these are longitude and latitude information which will get the location of the user if
you go down.
Yeah, exactly.
This is getting the exact location of the user G.P.S. information.
Let me search again for the same class to see where it is being used elsewhere.
So this is another call for the class.
And this is another call.
Let me see where it is being used here.
Nothing of any importance.
This is being used here as well in another class and not here.
When you declare it in a store for ground, it means that the service were run in the foreground, which
will give priority to the service and will not be killed even if the memory is low.
So this service will keep on running.
Now let's go do some keyword search.
Search for audio.
Take the string, Constance.
Let me see what's going on here.
And as you can see, there is access for audio and video by the application, which obviously shouldn't
be there.
That's me as well.
Search for stream.
No, maybe.
S upper case and nothing as well.
The search for sockets as socket is used here.
So sockets are obviously an indicator that this application is connecting with an external entity,
a socket case being declared here.
And I suspect, like some streams of data, stream of what seems of whites are being used down there.
Exactly.
This is a binary output stream.
There will be, of course, an input stream and so on, so forth.
So obviously, this application is doing some extra activities down there.