Mobile Malware Analysis

Prompts and answers

• What known as the first malware created to affect mobile devices?
  Cabir
• What technology does this worm used to multiply?
  Bluetooth
• What operating system did it infect?
  Symbian
• What message did it show on the screen of the infected mobile phone?
  Caribe
• What is the format of the file?
  .apk
• Decode the name of the sample.
  Malware
• Which is the target platform?
  Android
• What does Avast-Mobile can tell us about this software?
  Android:Metasploit-Q [PUP]
• What program was used to create the malware?
  Metasploit
• What is the package name?
  com.metasploit.stage
• What is the SHA-1 signature?
  74d442594acf11dc6e3492ffea5eb8956afd000d
• What is the unique XML file?
  AndroidManifest.xml
• How many permissions are there inside?
  22
• Which permission allows the application to take pictures with the camera?
  android.permission.CAMERA
• What is the message left by the community?
  THM{V1ru5-T0t4al-TWFsd2FyZS1BbmFseXNpcw}
• What is the programming language used to create the program?
  Java
• How many signatures does the package has?
  1
• Application is signed with v1 signature scheme, what is it vulnerable to on Android <7.0?
  Janus
• What is the App name?
  MainActivity
• It looks like there is a function calling for the package manager, so it can see all the installed applications. What function is that?
  b.getPackageManager
• What is the severity of this configuration?
  medium
• What is the SHA-256 hash of the file?
  bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a
• After finding the sample on VirusTotal, what does the "Avast" anti-virus engine recognizes it as?
  Android:Obfus-BM [Trj]
• With what we have, try to find out the name of the sample.
  Pegasus
• This became news for spying journalists, what year was that?
  2017
• What is the ID of the MITRE ATT&CK that is associated with our sample?
  S0316
• What technique has the ability to exploit OS vulnerabilities to escalate privileges?
  T1404
• There is a permission that when accepted, allows the application to access the list of accounts in the Accounts Service. What is the status shown by MobSF regarding this permission. (android.permission.GET.ACCOUNTS)
  dangerous
• What org.eclipse.paho.client file refers to properties of Portuguese from Brazil (pt-br)?
  org/eclipse/paho/client/mqttv3/internal/nls/messages_pt_BR.properties
• The malware has a special appeal for its safety and its internal components, reducing the risk of compromise. It has a functionality for its cryptographic operations with the feature of a random bit generation service. How can it be identified?
  FCS_RBG_EXT.1.1