In this video, we will analyze another application named Code for HK Dort HBK.
So let's start first by decoding this app, then decompiled iGate.
Well, open the terminal.
Let's close that.
And we'll run the ASPCA Tool D, then the name of the file.
If you list, you'll be able to see that there is a new folder or directly created.
Now I will use the decks to Joy Command.
In order to decompiled the HBK.
Another list.
And here we go, you'll be able to see the joy and the directive.
So we will start by analyzing the manifest SML file.
Double click on that.
Go to the directory.
And double click on the manifesto to XM file.
As we did earlier in the Georgian that you video, it's obvious here that we have dangerous permissions
like modify audio settings, change network states, receive as Hamas read us, Hamas, Reen, 3D phone
state.
And as you can see, all the remaining permissions are really dangerous.
Let's go down to see the activity tag.
And this is the main class that is initiating the application.
We'll see that later in the cool reception going below.
We are able to see some receivers defined in a tag fixed time record receiver and form receiver, as
well as some intense filters to change the phone state and create new outgoing calls.
So obviously this application is intending to do many malicious activities.
We'll go back.
We'll open Jaquie first.
Then we'll open the jar file.
Let me close those.
In the jar file, I'll expand the calm then the V one, I think.
Yeah.
This is the main activity class in where the application is being initialized.
Let's do some random keyword search.
As you can see here, we can spot like some access to the SD card and creating or this is really spooky
here.
It's creating a temporary HBK in the SD card.
We'll see that any while.
So this is obviously very malicious.
Like wants to initiate the application.
It is.
Opening cue, cue that SML and creating a new file in the SD card.
And moving this SML file.
To the SD card, obviously renaming it to APEC.
So here we can see that the queue queue as an AP key concealed under an Ximo file.
We'll see where's that located?
Let's do random search here.
Open that.
Let's start by searching for HTP location, client class.
So let's open that file first.
The first thing that caught my attention is the is utilizing Baijiu services, Baidu is a Chinese Internet
company here, declaration of some client location variables.
So obviously here we're getting the location of the client and storing it on by do location services,
as it's obvious here.
So this is the HTP requests.
So this is one of the channels, HTP channels.
The application is establishing that says will search for another thing here.
That might be of an interest, which is so Eskil and uppercase.
There is a class called by dual location.
I'll open the you want the clip as well.
So I've opened these two and the F dot class.
There is a declaration for an escort flight database, which is a local relational database on the Android
device, obviously storing the location of the user.
This is what I can see from the first site.
If you go to the seed of class file again utilizing the Eskil light database.
It's not obvious here.
What is the author trying to write and that?
But probably the location of the user.
Again, let school and perform another keyword search.
This time is address.
So we have to see the glass and I class.
Let's see what address is being used.
So here obviously passing Assamese data.
Again, as you can see, many malicious activities being performed by this application lets me close
that here, open the code for each key.
Again, go to the main folder on the assets, if I remember, was the Ximo file.
So if we click on that said two hundred kilobyte, ximo file doesn't make sense.
It's a big Ximo file.
So if we name it, as we've seen in the application, it's an AP case file and reimage to AP K.
And here we go.
She double click on that.
Okay, so let's run again.
The AP K will file.
In this terminal.
I'll decode.
The QQQ, the KPK.
Let's see what's in there.
And as well.
Decompiled it.
Perfect thoughts that we'll open the Q qad kay and open, as you can see, it is an AP gay application.
What the author is doing is that it is hiding the malicious application in the resources of the mobile
app on their assets.
And then when the main application starts skipping that to the SD acquired of the user renaming it and
there you go, you have a malicious application hidden in another application now on the SD card.
So let's open the manifest example again from the first site.
I can spot many malicious activities.
Again, dangerous and tense for the former states.
And you are going calls similarly using baijiu, location services, checking the words complete of
the application.
So again, it's of looks like a very malicious Xome file.
I'll close that.
Let's score again here to be assets.
Let's see what's in that conflict, Dot.
So here you can see again, probably or obviously, these are the eyepiece of the command and control
center.
This is the IP and this is the port number that the malicious application is communicating with.
Let's continue with our analysis for this malicious application.
Now we'll open the jar file.
I'll open J.D. Gooey.
And move the file here.
It's open that come.
So here we have by new services, Google Services and V1.
Let's expand the V1.
From the name of some classes, it looks very malicious.
Let's open the main activity detecting leaked the light objects.
Let's go to the phone receiver class here.
Obviously, this is the purpose of that is to monitor the phone can initiate new ongoing calls.
This quarter, checks talked.
Commented here, the heart beat.
Checking if the system is alive.
Let's go here to the stream receiver.
Establishing connection with external entities.
And here is another IP address, fisheye IP address.
This is opening the conflict, the DOT file that we've seen earlier to get the IP on the port.
No.
The rest is commented, it's open to a class.
Nothing interesting.
The UCLASS might look interesting.
Again, dealing with data streams and streams.
Nothing of interest here.
Take a class again, nothing of interest.
Hear the heartbeat.
Actually, he's checking the power of the system.
Getting the current activities on the system.
And the phone receiver.
These are the recordings.
Obviously, this application is recording calls with the current timestamp.
I don't think we need to do more analysis for that, because obviously the intent behind it is obvious.