一个简单实现apk推广并静默安装的样本分析

一个恶意推广自动安装应用

恶意行为：通过解析恶意url，诱导用户点击下载，并通过执行su实现apk的静默安装。

具体行为分析如下：

a:解析推广应用的下载地址

http://d.wk2.com/xsdata.json

[ { "name": "奇热小说", "ico": "http://en.upkao.com/teacher/ii1.png", "url": "http://tj.tt1386.com/392429987/6310000", "package_name": "com.qixiao.qrxs" }, { "name": "梧桐阅读", "ico": "http://en.upkao.com/teacher/ii2.png", "url": "http://tj.tt1386.com/451479425/3690000", "package_name": "com.wtzw.reader" }, { "name": "免费小说大全", "ico": "http://en.upkao.com/teacher/ii3.png", "url": "http://tj.tt1386.com/236300244/7540000", "package_name": "com.aikan" }, { "name": "秀色小说", "ico": "http://en.upkao.com/teacher/ii4.png", "url": "http://tj.tt1386.com/549479281/4920000", "package_name": "com.hzpz.thornreader" }, { "name": "阅读王", "ico": "http://en.upkao.com/teacher/ii5.png", "url": "http://tj.tt1386.com/047479549/2880000", "package_name": "com.book2345.reader" }, { "name": "掌读看书", "ico": "http://en.upkao.com/teacher/ii6.png", "url": "http://tj.tt1386.com/650479826/6560000", "package_name": "com.zhangyou.plamreading" } ]

 

b:执行su静默安装：

c:涉及到以上恶意行为的样本如下

9ee24d6fe0a81dec795477a8cae0b854

c6ca3eb88cb2126e808d10df7f57f0a5