Every Android application runs in a limited access sandbox.
If an application requires access to resources outside the sandbox, then the application needs to request
permission.
The application declares all the permissions it requires in the Android manifesto.
X-Mailer file.
Let's open the Trojan dash signed application that we have decoded and decompiled.
And let's open the Android manifesto.
X-Mailer file.
Expand that, as you can see here, on all versions of Android to declare that the application is permission,
we need to use this permission within the tags called user's dash permission.
These ones here written in blue.
The Android manifests file will start with the manifest tag and will close or ends with a manifest tag
and all the permissions will be listed within the use.
This is dash permissions tag.
Some permissions are considered normal.
So the system immediately grants them upon.
Installation or other permissions are considered dangerous.
As we've seen earlier in the slide.
So the user must explicitly grant the permission to the application.
Beginning with Android six point or API level twenty three user can revoke permissions from any app
at any time, even if the application targeted slower API levels.
So if the application is using your contacts yesterday, the application shouldn't assume that it will
still have access to your contact today.
So you can deny that permission at any time.
Let's see here.
Decoded application.
What are the permissions required?
Actually, we have couple of dangerous permissions required, such as read phone state, send them as
receive s.m as record audio call, phone, read contacts, write contacts, record audio rights settings,
camera read as someone.
Actually, all of these are considered dangerous permissions.
So this is the first thing to do.
So this is how we perform initial static malware analysis.
We start with the Android manifest of Ximo file and check the permissions.
The next thing that you need to know while working with this Xome of file is the activity tag.
Spotting these dangerous permissions is a great indicator for malicious activities.
If you want to have a comprehensive overview about dangerous permissions, you can refer to the Android
documentation in this video.
We will continue our analysis for the Trojans that a B.K. file that we have created earlier.
So I have gathered everything in this folder here.
As you can see, the APC, a file, the jaw file and the all the horses.
So let's go and check again the manifesto text Amelle file.
I'll open it now with the browser and.
Not a reader.
So we've seen earlier these permissions, if you scroll down, usually you'll be able to see some declared
services that might indicate the existence of a malicious activity.
But for the sake of going further and analyzing the jar file, notice here the activity tag.
It starts with a label than an Android name.
This is the name of the main class that will initiate the application.
So remember that it's called main activity.
We'll close that and go to the jar file and open it.
And the jadi go.
So let's move that here.
Well, open Geddie QE and expand it a bit.
So here you go.
This is Judy Gooey, this is the interface fit on the left side.
You will see the list of classes declared by the application.
And as we've seen earlier, the initiating class is main activity.
So under that, you'll be able to see the constructor.
Actually, there's nothing spooky about that.
It's just initiating the application.
What we're going to do now is perform some keyword search.
As we've seen earlier, we have some recommended words that we need to search for to inspect any possible
malicious activity.
Let's go here and press on that button, which is the search button.
And as you can see, you can search by type field, string, constant, modu, et cetera.
Remember that the search functionality NJT Gooey is case sensitive.
So I've done some analysis earlier to this file.
And one of the string constants that we can search for is socket.
Let's enable this string constant here and let us search for socket.
So as you can see, we're using this and lowercase s it will find nothing but uppercase s.
It will indicate that in the payload the class there is something or some declaration or socket.
So let's close that and let's search again for socket here.
If you scroll down.
So as you can see, this is a declaration for suck it suck, it means your ex establishing connectivity
with an external server coming and going.
This might indicate that there is some input and output streams established by the application.
Let's go up again.
Because I've noticed something not usual.
This is a more application, by the way.
And you can search it manually without going through the search, keyword search or the search list.
As you can see here, there is some declaration of a data structure of arrays.
And these numbers are seriously not clear.
This might indicate a combination of the IP and the port that this application is establishing connectivity
to.
So you can scan it manually.
Obviously, this is the most malicious class within the application.
So we were able to spot some sockets which indicate connectivity to external server and the declaration
of malicious or unusual kind of data structure.
Another key word that we can use in our search is HTP.
So let's open this search again.
Android age DDP, which might indicate as well certain connectivity to external servers.
Obviously, let's close that.
Here is a declaration for HTP.
Let's do another search in the beat of the class as well.
There is another declaration for each, which as well might indicate certain traffic or certain connectivity
established with an external entity.