So far we have seen how to develop an Android app and how to analyze a potentially malicious Android 1
app. 2
In this case we're going to look at an actual malware sample called simple locker or simplocker. So 3
simplocker is ransomware. 4
It is a bit old but it is a very good sample to use in a training course. 5
I say this because within the analysis we'll be able to extract very useful information that can be 6
used to decrypt the files that were encrypted by the ransomware. 7
So what we will do is analyze the ransomware determine how it encrypts our files and develop a tool 8
that is able to restore our data by decrypting the files. 9
In other words we're going to create a simple locker decryption tool. 10
Simplocker is an interesting sample because we have all the information needed for decryption within 11
the source code. OK. 12
So koodous.com is the online sandbox I mentioned earlier. 13
It's useful for doing automated malware analysis but more importantly it's a useful resource for APKs 14
Once you sign up you'll be able to search for apks by using search fields like malware family 15
name and find APK 16
You can search by hash, app name, develope,r package name, tag and so on. Tag is quite a useful search functionality 17
Koodous has a large research community. 18
And if someone would have tagged simple locker as simple locker then you should find all the associated 19
samples through the tag. So here you can see that someone tagged this specific malware. 20
Or rather this specific APK as simplocker. 21
And they also tagged it as ransomware. 22
If we search the tag ransomware we'd probably find a whole bunch of other ransomware samples. 23
This would be useful if you're doing research on ransomware samples and here detected means that it 24
was detected as malware, so let's click on the simple locker sample. 25
Here we see that it has an analysis section and here's where the analysis part comes in. 26
So this is where you can see the hashes and basic AP case data. 27
Here is an automated result of Androguard. we saw Androguard and the possible results it can produce 28
earlier on. 29
So for example here it shows there is a main activity. 30
Here there are two receivers, a few URLs, this here is quite interesting. 31
We can see that it uses Tor over here. 32
There are two services the Tor service again indicating that it probably uses Tor. OK what else ... a few 33
filters, permissions, here we can see that it writes to external storage. 34
So that's quite interesting for us. 35
What else. 36
It says that it uses crypto. 37
This is probably used to encrypt the files, network. 38
OK. 39
There are some network communications we can resolve these and try to identify the URLs if necessary 40
Droidbox. 41
This is a malware dynamic analysis tool. 42
The thing is it's a bit of an old tool. 43
So that's one of the reasons why we didn't show you droid box. Here it seems 44
they ran it against droidbox. 45
We can see that there are a few file writes, file reads, service started, Dexcalls, so there is dynamic 46
code loading. 47
So yes there's a lot of information we can obtain from here from an automated analysis report. However 48
we won't just be relying on this information. 49
We'll be going deeper using the analysis tools that we demonstrated earlier on. First will run the malware 50
in our emulator and we'll see what the impact is. 51
So here will confirm that it's actually encrypting our files, then we'll analyze the sample and hopefully 52
we'll be able to extract the code or the information that would help us to decrypt the files that are 53
being encrypted. Finally, 54
we'll try to decrypt the files on the emulator to show that our decryptor tool worked.