2

I found that some client apk triggers multiple red flags during VirusTotal scan:

https://www.virustotal.com/#/file/6341be988be00042c698511fd88c97c618e6109afac40fdf5bed52383bcdf18e/detection

Exploit.Linux.agz, TROJ_GE.521F1419, TROJ_GEN.F04JC00IA17

Looks pretty serious. But how do I interpret those results? How serious and how trustworthy they are?

2 Answers 2

3

Koodous (a cloud-based mobile-AV scanner) does not do an analysis of this particular APK -- https://koodous.com/apks/6341be988be00042c698511fd88c97c618e6109afac40fdf5bed52383bcdf18e

but if you look at the subject and issuer attributes for the Android certificate, this malicious app is similar (contains the string rtt) to other ones that have been analyzed -- https://koodous.com/apks/6cea48dd0aa2cf5d5bfcf6c8a162f5a13624aa4429ee494c0f8d6583b204a98f -- (VirusTotal for this second one here -- https://www.virustotal.com/#/file/6cea48dd0aa2cf5d5bfcf6c8a162f5a13624aa4429ee494c0f8d6583b204a98f/details )

This analysis clearly shows that 8 out of 97 Koodous-analyzed APKs with the same cert also contain adware/malware -- https://koodous.com/apks?search=cert:2DAF3283B6EA6F38238102C7B236A22E85A4C2F1

If you look at the Interesting Strings section for the APK you ran through VirusTotal -- https://www.virustotal.com/#/file/6341be988be00042c698511fd88c97c618e6109afac40fdf5bed52383bcdf18e/details -- you will see http://api.share2w.com/stat/adrequest, which is a malicious domain and URL.

As the other answer eludes to (and in the same details section described in the last paragraph), the APK contains one or more Linux executables. In your APK's situation, at least one of the binaries it includes was found on the filesystem as /r/m/su.png which is the su binary used for Linux/Anroid privilege escalation. I have no idea why this made it into the Google Play Store, but the APK is also available in the AppChina app store / app market.

In addition to the su binary, the APK also contains the following suspicious/malicious code:

private void a(File object, InputStream inputStream, String string2) throws IOException, InterruptedException {
    int n2;
    if (!object.getParentFile().exists()) {
        object.getParentFile().mkdirs();
    }
    String string3 = object.getAbsolutePath();
    object = new FileOutputStream((File)object);
    byte[] arrby = new byte[1024];
    while ((n2 = inputStream.read(arrby)) > 0) {
        object.write(arrby, 0, n2);
    }
    object.close();
    inputStream.close();
    Runtime.getRuntime().exec("chmod " + string2 + " " + string3).waitFor();
}

It probably also contains other malicious logic, but these are enough to conclude that the APK is indeed some sort of adware/malware.

4
  • thank you for detailed comment! for su.png - maybe I'm not seeing it, but it seem to be normal png that contains slider image
    – vmg
    Oct 9, 2017 at 22:06
  • 1
    @ vmg: ah, ok maybe a false positive -- but it does run this code: public static boolean g(Context object) { boolean bl2 = CommonUtils.f((Context)object); object = Build.TAGS; if (!bl2 && object != null && object.contains("test-keys")) { return true; } if (new File("/system/app/Superuser.apk").exists()) return true; object = new File("/system/xbin/su"); if (bl2) return false; if (object.exists()) return true; return false; }
    – atdre
    Oct 10, 2017 at 14:10
  • 1
    Run this through joesandbox.com. Their report is rather complete and shows that this APK is not only malicious but more than just adware. It looks to have the capability to steal payment cards from whatsapp -- so it is more of a banker than just adware.
    – atdre
    Oct 10, 2017 at 17:20
  • I went through the report on the joesandbox and looks like for the most part it is full of false positives (how they detect overlays, credit card stealing, dropped files). unfortunately :(
    – vmg
    Oct 11, 2017 at 0:14
1

3/62 is a pretty good score even with Kaspersky, Bitdefender, Sophos, Symantech & Dr.Web in there. But i am pretty sure they are not designed to scan with Mobile signatures, try using a android based AV scanner to clear the clouds.

The app might get flagged as trojan as it contains one or more Linux executable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .