OK so let's try and run this malware on an emulator and let's try to understand what's happening during 1
execution. 2
Before we do this though. 3
I have to make a disclaimer. 4
It's not really recommended to be executing malware. 5
You definitely don't want to download this APK and run it on your actual device. 6
Definitely do not do that. 7
Here we are running in a contained environment. 8
We're running on an emulator on a P.C. that's dedicated for this specific work. 9
We are also going to disable the network connectivity in other cases you may want to configure a proxy 10
and take other measures. 11
But here we are outright disabling the network connectivity if you're not confident in what you're doing 12
don't execute the malware, just follow the video and don't stay experimenting. 13
The last thing you want to do is download this APK on your phone and install it definitely do not do 14
that. OK. 15
Back to koodous. Koodous has this cool functionality where you can download the APK samples so here we just 16
downloaded this simple locker sample but before we do anything else let's create an emulator. So we're 17
going to create an emulator. 18
That's an old Android version. 19
The reason being that this malware is old. 20
So just in case it didn't handle any permissions or anything like that let's just be safe and run it 21
on an old emulator. 22
We already have a version 16 emulator configured so let's work with that. 23
Let's call this simple locker and configure hardware acceleration. 24
Remember if you're running in a VM you probably want to use software acceleration. Default settings should 25
be good. When you are done click finish. OK. 26
So we've created the emulator. 27
And next we need to run it but we're not going to run it from here. 28
We're gonna have to look at another way of running the emulator so let's go ahead and close Android 29
Studio, go to the SDK folder, so in our case it's Android dash SDK, here you'll find a folder called emulator 30
and if you go within emulator you'll see that there's a tool called emulator. You can use that to launch 31
your emulator. To do that 32
you just do emulator dash AVD and the name of the emulator you just created simplocker. OK. 33
And this will launch the emulator using the emulator tool rather than opening Android Studio every time 34
and opening the AVD manager. So here we see that the new emulator is launched. 35
Let's go ahead and add the SD card so you have to go to API demos content storage external storage and 36
click Create. So let's go back to our terminal and run adb shell 37
if you go to SD card, go to pictures we will see that we have a demo picture over there. 38
So what we can do here is adb pull, so go to SD Card Slash pictures and you will see demo picture dot JPEG 39
so let's pull this adb pull. 40
If you remember is used to bring a file from the emulator to your device type ADB pull and the path. 41
Now if we go on downloads we see that we have a demo picture that is provided by Android over here. 42
What we want to see now is whether simple locker encrypts this demo picture. 43
Let's go ahead and remove this demo picture from our downloads folder. 44
Ok. 45
Now before we connect we're going to turn off the internet connection just in case. OK. 46
And now we can run adb install the file starts with eight and install the APK that we just downloaded 47
from Coodous let's have a look and we can see that it's been installed. 48
Now the user has this malicious application and once he clicks on it he's prompted this notification 49
which seems to be Ukrainian it is saying something along the lines of. 50
OK we have your data you've been going on sites that you shouldn't have been going on you need to pay 51
this amount to so-and-so. 52
And as you can see you can try to minimize it but it will keep prompting you with the message. 53
So this is the ransomware we installed the malware and we're stuck with it. 54
Now let's remove the malware using ADB. ADB uninstall org.simplocker. OK. 55
So it's uninstalled. 56
Now the problem is if we have to run ADB show again and go to SD Card Slash pictures we can see that 57
the malware has encrypted our file. 58
So by simply uninstalling simple locker we didn't get rid of the problem. 59
We have a situation where all the files on our device have been locked and encrypted. 60
So let's confirm that the files are encrypted again using ADB pull let's do ADB pull to obtain the 61
encrypted file and we can see over here this is our encrypted file so that is it for now. 62
Next we'll see how we can get useful information through static analysis of this sample. 63
The goal is to gather enough information that will allow us to decrypt the encrypted files.