Now it's your turn.
You're going to dig into this Malware sample.
You are going to answer key questions.
And you are going to find out, what was the person thinking
it was supposed to do?
What services are running in the background?
How malicious is this software?
And could you potentially figure out
if it's stealing information, how it will name it?
Make sure, when you go into your VM,
you realize there is not a G Cases 4.3B.
If you did not complete lab 4.3A,
you won't have the piece of Malware.
So you're actually going to have to load that Samsung extraction
and export com.battery.extender.apk
to complete this lab.
We are now about to review lab 4.3B.
If you're still working on decompiling this Malware,
just press pause, and then come back when you're ready.
The first question is asking about what
is this app designed to do?
So what is it really called, essentially?
So if we go to the AndroidManifest,
and we look all the way at the top,
we are going to see that it was advertised
to be battery.extender.
However, when it's installed, com.process.system.
And you may have found this as well in the last lab
if you exported base.apk because it was in the directory called
com.process.system.
And you can also see the version for this Malware.
As far as permissions, there are so many that are listed here--
when you start looking at some of these, it's frightening.
Like, RECEIVE_SMS, access your locations, SEND_SMS.
You can see CALL_PHONE, has access to your camera,
RECORD_AUDIO, read your contacts, write to contacts,
write to call log.
It's really bad.
So all of the permissions are listed in AndroidManifest.xml.
Now let's keep digging.
This is one of my favorite ones.
Can you locate any services that are running?
So if you are not frightened by some of these apps yet,
you can even-- honestly, you should do this
with some of the regular apps that you use.
I'm going to type service, and I'm going to click on--
all of these just so I get the best or most information.
But look at here we see killer mobile, AfterCallRecorder,
AudioRecorder, ChatCollector, FacebookPhotoCollector,
GmailCollector, SQLiteAdapter, which means it could go in
and edit databases.
This is one of those perfect examples.
This Malware could have a copy of some of these files.
So if the user deleted it, it could potentially help you.
SkypeChatCollector, ViberChatCollector.
It looks like it's going, not only for your regular
permissions that you gave it access to, but any third-party
apps that have access to those permissions,
it's going and stealing additional information--
not exactly a good trait of something
you want on your mobile device.
If we go into the File System over here--
so if we go into tmobile and tracer, and we look at service,
this is another way that you could
have found what it's stealing.
So if I just scroll up a little bit and then zoom back in,
you can see specifically each and every one
of these on what it's doing.
And you could look at the code and see how it's doing it.
OK, for the next one, the application checks for root.
I want you to think about why an app would want to do this.
Because if you have root access, you
really have the keys to the kingdom
and could do many things with that device.
So what we want to do is we want to find where
the root is being checked and how it actually
looks to the user.
So if we go out into our services here,
you're going to find this root.
And what it's going to do is show you the different methods
that it uses to check for root.
So the first one, it checks for a systembin
to see if it's still superuser.
The next one, as we keep going down-- just
keep clicking on the left, and you'll see them on the right.
You can see here that it looks for build tags,
and it runs something called test-keys.
We could see here that it checks for Superuser.apk
and then executes a SHELL to see is, it Superuser?
So are you getting the hashtag, pound symbol,
or are you getting the dollar sign?
Most pieces of Malware want to be root.
Now, if it's stealing your information,
can you figure out, if it records
a video, how it's going to actually save
that on the device?
So if we go out to activity, we can see here we
have VideoCapture and if you look through the code
you should ultimately be able to see how it's going to name it.
And we can see here it's going to be formatted with the date
mp4, so this is what we're looking for.
So then what you could do is go into your extraction
and see, in those specific locations
I told you about in section 2, if there's anything sitting
there waiting to be xfilled to the server that's
stealing their information.