So now we have our simplocker malware. 1
We saw the results after running on a public sandbox but what we want to do is analyze the APK and see 2
if we can obtain any useful information from this APK.. 3
And ideally this information can be used to decrypt our files that are encrypted on our emulator. At 4
this point on your emulator. 5
You should have the encrypted files First, 6
If you remember we had a tool called JDGUI. 7
We had placed this in downloads but before we run JDGUI let's run Enjarify which is a tool that 8
we need to run against the APK to be able to upload the jar file to J.DGUI so to do that we go 9
to user local enjarify and here we have the script and enjarify.sh and we're going to run it against 10
the simplocker.apk 11
So this might take some time, it seems like there are quite a few classes in this app. 12
So here we're converting the APK into a jar file so then we can import the jar file into JDGUI. 13
In the meantime let's run JGUi so Java minus jar JDGUI. 14
There we go. 15
And over here once we see that enjarify file is complete we just need to import that jar file that 16
was generated so if we had to go back into our folder here we'll see that it generated a file. 17
OK. 18
Now we'll just import this jar and there you have it. 19
You have your source code just like with bytecodeviewer. Actually byte code viewer uses JDGUI as 20
a Java decompiler in the background among other Decompilers. 21
So one thing you may notice here is that we are running in JDGUI and not in bytecodeviewer. 22
This is because there is an issue with this specific APK so if you try to run this APK in bytecodeviewer 23
or actually you try to run APK tool on this APK you will receive errors. 24
This happens occasionally with APKtool i.e. receiving errors when running APKtpol, usually it just 25
requires an upgrade of the APKtool version because it would have some bug or some unsupported code. 26
In some cases like in this case, 27
I suspect it has to do with the special characters so it could be that they have some Ukrainian or Russian 28
or Chinese characters in the application because of this APK tool which uses job in the background 29
is causing the app to crash. 30
There are ways to fix this. 31
It's usually on a case by case basis. 32
To be honest it's not really worth investigating for this specific case because it's a bit out of scope. 33
What we want over here is to obtain Java source code which we can try with JDGUI 34
And in this case it works. 35
OK. 36
So that's just a side note, so here you see that there are different packages. 37
But if you remember in the automated analysis we saw that there's a package called org dot symplocker 38
which is where we have a lot of the main code. 39
So for example here there is the main class which launches the main service. 40
And then you can follow the main service and you can see that for example here they are starting a tour 41
connection or they're checking if there is a tour connection and then starting at we're not going to 42
go through all of the code but this is where you could get some useful information if you had the time 43
to go through it. 44
So for example when you see that it opens a Tor connection you might assume that maybe it's connecting 45
to a command and control server then using dynamic analysis say through objection we could hook on to 46
specific calls we identified here and see if any data is being sent from the server to our application 47
but we're not going to go through this right now. 48
We're just trying to look at the code and trying to see if there's anything useful over here for decryption 49
so let's have a look. 50
Here is quite an interesting class actually this class is called Constants and as you can see in Constants 51
you have some interesting data listed very clearly. 52
For example here you have the admin url. 53
So it shows what is probably the command and control server they left it statically defined and in clear. 54
Here we are quite lucky. 55
But this is not always the case. 56
This is actual malware that was locking people's devices. 57
So this kind of information is actually found in malware but here's the most important thing we have 58
the cipher password which is extremely useful if we know what it's encrypting with. 59
Hopefully we can decrypt using the same cipher keys. OK. 60
And here's something interesting as well we can see what file types are being encrypted, extensions to 61
encrypt. 62
So these are the extensions that are being encrypted and in our example picture we saw that it actually 63
was encrypting the JPEG and renaming it as JPEG dot ENC. 64
So that kind of matches with what we saw when we ran it on our device. OK. 65
Let's see over here there's a file called AES script. 66
Here we can see that they have a function called decrypt 67
and there we go. 68
We don't even have to do the work we don't even have to try to understand what the encryption part is 69
doing and try to reverse it because they are actually kind enough to offer us the decrypt function which 70
in the next step we'll try to copy and paste this code into Android Studio and see if we can produce 71
our own decryption tool. 72
So this is quite important for us. 73
We saw what the cipher key is. 74
We saw that they're providing a decryption method. 75
So now we can start thinking of maybe creating our own Android app that parses through all the files 76
that have been encrypted and run this decrypt method on top of it passing the cipher key as a parameter. 77
Here we can see the files to encrypt being used. 78
So OK it seems that there is a file encrypt your class. 79
They have a method that gets all the file names. 80
Here there is a recursive function where they're passing through all the files where they want to encrypt. 81
Then they have an encrypt function which goes through all the files to encrypt runs AES script. 82
With this cypherkey and encrypts all the files. 83
So here we can see that our assumption of what the ransomware was doing was correct. 84
And we can see the key being used so just over here with a quick analysis of some very clearly named 85
functions and classes we can see that there is a command and control server. 86
We found what the server is. 87
We see that it received some commands from the server. 88
We see that there is an encryption class. 89
We see that the encryption class being used is AES even better than that. 90
We have the cipher key that is being used. 91
So again we have a lot of information here hopefully using all this information we obtained from just 92
static analysis, 93
we'll be able to decrypt our demo pictures and in the case of an actual malware you'll be able to restore 94
your system by decrypting the files.