【An Analysis of the AnserverBot Trojan】

AnserverBot Trojan   

这片论文是Xuxian Jiang  教授研究的成果，Xuxian Jiang教授在ANdroid 安全方面研究显著，特别是对Android恶意软件的工作方式，本文就算针对  AnserverBot Trojan进行的研究，分析它的恶意行为恶意部分。

资料：http://www.csc.ncsu.edu/faculty/jiang/AnserverBot/

how   it   works

1、安装payload

      动态加载：当宿主app触发的时候，会弹出一个假的更新窗口，当你选择确定键的时候，它会去安装一个隐藏的payload A，这个payload A会在后台默默运行，而且不会在屏幕上留下图标，即使你将母包删除，这个payload仍然会运行。与之前研究的BaseBridge【如下】比较相似。

• A.BaseBridge

  • Name	A.BaseBridge
    Category
    Release Date	2011/06/07
    Update Number	1

    BaseBridge comes in a series of pirated, trojanized, host applications that are designed to appear legitimate to an Android user. BaseBridge infected applications leverage the "udev" (BID 34536) vulnerability in Android 2.2 devices and below in order to obtain root privileges on an infected device.
    
    Once root privilege has been obtained, BaseBridge infected applications will drop its payload, which is "SMSApp.apk", which is stored in the application package in "/res/raw/anservb". Once successfully installed, "SMSApp.apk connects to a remote server of port 8080 in order to send device identifying information, such as: "Subscriber ID", "Manufacturer and Model", and "Android version".
    
    Secondarily, BaseBridge infected apps are configured to send a series of SMS messages to premium rate SMS numbers that will charge the user's mobile account per message. These funds are almost always unrecoverable. BaseBridge can also remove SMS messages from the mobile device's inbox, so as to reduce the chances of the user noticing the premium SMS messages being sent, and can dial phone numbers without the caller's consent.

2、执行payload 

      与payload A 不同，payload B不是在手机上安装的，而是当宿主app运行活在 payload A 运行时进行动态加载。它利用了 Dalvik virtual machine的动态加载功能，与Plankton spyware比较相似，不过相比 Plankton spyware，它更进一层，它对敏感的寒数调用都进行了加密（也就是说静态分析不能够分析出来，只能够进行动态分析）

3、获取payload的条件

       使用了远程调用的指令：两层，第一层指向了一个已经加密了的博客，用来存储第二层的指令和最新版本的payload B。通过将第二层的指令进行解密，我们即可以得到payload B。 

4、具有保护策略

      1）、payload A与 B 代码严重混淆，难以进行逆向分析

      2）、防止篡改与再度重打包，如果发现特征值不对，则会拒绝执行

      3）、关闭安全软件