OK, lab 4.3A, Hunting for Android Malware--
you must do this lab before 4.3B.
The reason-- you have to find the Malware.
If you don't find the Malware, you can't do lab 4.3B.
So make sure you take your time with 4.3A.
If you have never worked a Malware investigation before,
up until this point, you have worked applications.
You know how to hunt for applications.
You know your Android cheat sheet
tells you what's running in the background,
where to find applications of interest.
Use that.
Hunt for the application.
The Malware is an application.
It's just doing really rogue and nasty things.
Let's take a look at lab 4.3A.
So I'm in 4.3.
AXIOM has been pre-processed for you.
AXIOM is really helpful in this lab
because it hashes all the files in a nice way
that you can sort by it.
Physical Analyzer hashes as well,
but it's not as easy to manipulate the file system
to get to where you need to be for these specific hash values.
Hash values of the apps will be very relevant in this lab.
So I'm going to load this data in AXIOM.
I'm going to load it in Physical Analyzer.
And we are going to start this investigation.
Now, as far as tips on where to start,
this is where you being the artist comes into play.
I have so many students attack this lab in different ways.
When I review it with you, I'm going
to try to share with you some of the unique mindsets
that students have shared with me on, this is how I found it.
Think of it as an application.
It's an application that's just doing bad things.
Now, the user, if we look at this lab,
the user shares some key hints with you.
So when we go through and we look at this,
the user of this device supplied you the phone that they think
is infected with Malware.
She admitted she did have USB debugging enabled,
and she has accessed .apk files outside of the Google Play
Store.
So what this means is, if you were looking at local App State
DB, it's not going to help you, because what
if the Malware didn't come from the Play Store?
She was able to provide you a time frame of January 1, 2019
through January 5, 2019 when the device
may have become infected.
You have a full physical image that was acquired with UFED.
You can use Autopsy, AXIOM, Physical
Analyzer, whatever you choose to work this investigation.
Now, the lab is going to step you through the scenario.
If you don't want to use the lab questions,
if you just want to play, let me see what I can find,
don't read these.
Because this is going to kind of hold your hand
along the investigation.
If you want to work this like a real incident response
case, your goal--
can you find any suspicious applications?
If so, did the user install them?
If so, how did the user get them?
So how did this Malware land on the device,
and did the sender or attacker try to hide it in any way
or obfuscate it in any way?
Good luck.
We are now going to walk through lab 4.3A.
If you're not ready, simply press pause,
and then continue when you would like
to see my methods for chasing down this Malware.
You can follow the E-Workbook step by step.
What I want to do is show you different ways
that students have identified Malware.
I'm going to start in Physical Analyzer.
And this approach I'm about to show you I think
is pretty interesting.
So if you go to the applications,
whether you go through Analyze Data,
or click on the Application Insights, switch to Table View.
And then what we want to do is just do
a little bit of filtering here.
So the first thing I want to do is
choose the ones that are not decoded by Cellebrite
because chances of Malware being decoded
are probably slim to none.
And then I'm going to also scroll over.
And I want to sort by Permissions, so the ones that
have a lot of permissions.
And ultimately, what I want to look
for are apps that may no longer be in the App Store.
So I'm going to scroll over here and see if we can see anything
where it alerts us to that.
So heavy permissions-- the ones that have a lot.
If you've see anything that says app may not be from the App
Store or any of those types of messages, those are helpful.
So as we start looking through here,
we can see we have some Running app, Root Spy, Antivirus.
I'm going to keep scrolling down.
This is what we're looking for.
So I'm going to change this category to this--
App May not be from Store.
Now, when we look at this, right away,
we see that com.process.system.
Let's take a look at information about this app.
So it tells us it was in the foreground.
We see the version.
And we can see the manifest file for it.
If you look at this, it tells you
it has permissions to phone, to tags, to social, to camera,
to storage, locations, messages, microphone, network.
That looks like it's interesting to us,
so I'm going to click on this.
And let it take me to that directory.
And here is the actual application for that.
So that's how one student found it.
But now, even if you have this, you
have to figure out, how do they get it?
So you could technically export base.apk at this point
if you wanted to.
You could look at File Info, and we don't have
any date/time stamps for it.
So this is where you could look at the AndroidManifest.xml
and see if you have any file info,
but we are not getting a lot of information from this.
Let's see if I click on base.apk.
Now I have a date.
So now this is interesting, 1/4/2019.
What I recommend is that you timeline around that time,
and then you would find all the chats.
But let me walk you through a different way.
So that is the way of going straight to the applications.
I personally, have never worked a Malware case that way.
What I would typically do is go into the file system
and look for the locations that I told you about in section 2.
So remember how I told you cache is commonly empty.
This has three files in it.
Let's take a look.
So one of the first ones we see is this Chainfire auto root
And we can see it's from the 5th of 2014.
She did say she used USB debugging.
But this is a good clue to you that this device was rooted.
Now, does it have to be rooted to have Malware?
Absolutely not, but it does make it more susceptible.
So here we could see that Chainfire root log.
The next thing I would do after looking at cache
is look for downloads.
So if the user saves something, where will it go?
And I look in these NO NAME files
to see if I find anything.
Doesn't look like it's of interest.
So now I want to go into userdata
and see if I can find the media directory or downloads.
So here's media, primary user, downloads, seven files.
Let's check this out.
Now, this is interesting.
When you download apps from the App Store,
they do not get downloaded right here.
This is unusual.
So the fact that we have this battery.extender.apk,
whatsapp-1-1, and whatsapp-1, that's of interest to us.
Now what I'm going to do is I would export all three
of these at this point because they are abnormal.
And you need them for part two of the lab.
So I'm going to go into Cases, Lab4.3,
and I'm just exporting every single one of these,
just in case.
If you don't need them, you can delete them.
What we can also do is look at the timeline of these.
So we see 1/3--
it looks like 1/3/2019, 1/3/2019, 1/3/2019.
But then we have this Coursepage.html.
If you click on that, we can see some information here.
So I was hoping you'd stumble upon this.
You can read this, "Sign up by clicking here."
If you hover, you will see that's actually to a Dropbox,
to com.battery.extender.apk.
The person clicked on, "Sign up by clicking here,"
and battery.extender.apk was downloaded.
So that's interesting.
This one here is some spam for you to take this course.
So that's legitimate.
Now, what we want to do is look at the date/time stamp
of this file.
So 1/3/2019 around 19:54 UTC.
Let's go into Timeline.
Let's change this to 1/3/2019.
I'm going to do 1 day and see if that's enough to start.
I'm also going to get rid of some
of the things that are just noise,
that aren't going to help.
Like, cookies probably aren't going to help.
Download email images won't help.
Search items will.
Web history will.
OK, that looks good.
You can always add more.
But we want to see if we can find,
how did the person get this?
So as we start looking, we see there's email.
And look at this, magic--
Coursepage.
So we could see that mraceventura1980
sent an email that says, hey, there on 1/3/2019.
We could see that it has two links in it.
It's from Liz Lemon to Ace Ventura.
As we scroll down, Coursepage.
And she says, it's been too long.
Thought this might be something you would like.
So how she hid this, she attached it,
she put an embedded link that led him to get
that com.battery.extender.
So you can see that portion of this.
So now he keeps going, checking email and hang out.
So then there's this one from Lloyd Christmas to Ace Ventura.
We can see it says, here's a little something
so we can keep in touch.
And it has a URL.
And we could see it's that new WhatsApp.
So this one was hidden within Google Drive.
And if you look, there's the URL,
and it downloads new WhatsApp.
So through Hangouts was that chat.
Now, what would make your life easier when we're looking
at these .apks.
This is where I don't like how Cellebrite doesn't have
the hash values right in there.
So if we go into Magnet into AXIOM, and we look at--
I think that's how it spelled, newwhatsapp.
And if we go into--
I actually want to search this in file system.
So a good reminder here--
we go into File System, we stay at the top partition,
All Subfolders, and I'm searching for newwhatsapp.
And I have no hits.
So then what I'm going to do is click on this one.
Oh, goody, it does not want to work.
So maybe it won't assist.
Let me go back into Artifacts.
I just want to get the hash values.
Come on, AXIOM.
If we go into--
it's actually not going to make it easy on me.
So I'm going to go back in to Cellebrite here in a second.
Let's see, Android Downloads--
all right, this is what we need.
So when we're looking at WhatsApp, what I want
is for it to show us the hash value,
and it doesn't seem like it's even doing that right now.
Not of assistance.
OK, I'm switching.
This is where you'll see my frustrations,
and I go back and forth in the tools.
We need to know the hash values of these files.
So we can say, if they are the same, if they're different--
because whatsapp-1 one and whatsapp-1.1,
why is it named something different?
So what I'm going to do is I'm going to go back
into the File System.
I'm going to search for WhatsApp.
And you could even specify more than that.
I could search for com.whatsapp-1.
And that definitely took it down to 16.
That's better to deal with.
And what we want to do is find the hash value.
So this is what we want.
So here we could see it's 4db.
So we could see that's the one for 1.1.
And if you look for the other one, they're exactly the same.
So technically, you only have to export one.
This was put there twice.
Remember when we said that, if you click on something that
could potentially be Malware or sideloaded,
it will double-download.
It's the exact same file.
Now, if you look at this .apk, this is actually not Malware
at all.
It has led to just distract you.
It is something that's abnormal.
The real piece of Malware is that com.battery.extender,
when it installs itself and installs
as that com.process.system, which is the Tracer Killer
Mobile Spyware.
Now, one of the most unique ways I've seen someone find this,
and it kind of blew my mind--
and this is only because Chrome was used.
If you go into Physical Analyzer,
and we go into Downloads under Web History for Chrome,
look at this little tidbit over here.
It tells you immediately, the URL
was Dropbox, where the Malware was downloaded to, when
it was downloaded, how big it was, that it completed,
that it came from Chrome History.
And it tells you the downloads.
It tells you the URL, the entire chain.
If we keep scrolling, it tells us the referrer was Dropbox.
And it gives us the hash value and says battery.extender.apk.
It gives us everything we really needed except who sent it.
So then you could just timeline on these dates
and walk your way out of it.
But what I need to make sure that everyone
does at this point is, you either
download battery.extender.apk, or you download and save
the base.apk for com.process.system.
So you have two choices.
I think the easiest way to get it
is, if you go into Media Downloads and just Right-Click
and do Save As, you need this for part B
because I'm going to teach you now how to decompile it.