Russian FruitNinja Backdoor Analysis

For my research, I chose to analyze a popular Android application for malwares. But why select a Russian version? Well, it made a compelling case study from analysis perspective that I later found out during my research. The application I selected was popular game called FruitNinja downloaded from Russian Fake Android Store (Figure 1).

Figure 1 : Russian Fake Android App Store

Steps for Analysis:

Application PacKage (APK) is the file format used to distribute and install application in Android phone. This is zip archive/package based on JAR file format which contains the certificates, assets, resources, manifest file, and DalvikExecutable(DEX) containing the actual program code.

On changing the APK extension to ZIP, I got the extracted archive as shown:

Figure 2 : APK Extracted

AndroidManifest.xml is the Android Binary XML describing the name of the application, version, permission rights, and referenced library resources. To make the file into human readable XML format, I used python script manitree.py for conversion.

Figure 3: Manifest Permission Audit

Here, the manifest auditing result reveals FruitNinja’s permission of sending and receiving SMS which was catching in the very first glance. Also the resource folder (res) was quite interesting.

Figure 4 : Server-Side Polymorphism

A quick glance to the picture files reveals a common face in all pictures. So, who is that guy? Intrigued, I probed further using Google image search resulting in a Russian Meme Character from “Bestman from Fryazino”. In Russian context, Bestman is a term used as a reference of “witness”

Fryazino Story:

A leprosy user made a series of photos, including a witness from the groom of was at a wedding in the suburban town of Fryazino. On all of them witness depicted in the same posture and same expression. The bestman’s picture (black jacket &white pants) is replicated separately with Photoshop morphing with dark contrast background. A Russian wiki says this guy’s name is “Alex”.  But it doesn’t make any sense to the analysis; rather it was just another piece of information. Nevertheless, this picture was found to be in many malwares.

But Wait!! How does it matter with FruitNinja?

The main reason is that these “temp” files can change the application fingerprints, and eventually bypass traditional signature based antivirus scanners by providing a different pattern. This is a classical AV bypass technique which is known as server-side polymorphism found in many windows based malwares, and now it’s been found in popular Android applications such as Instagram, Angry birds, etc. Each time when a user downloads the application, it creates a different unique mutated version of the same file.

Analysis of Dalvik Executable File

Dissembling dex file can be done in two ways.

• Smali Assembler/ Dissembler
• Dex2Jar Converter

Dex2jar converter is handier as it will generate a java archive (.jar file) which is basically the source code itself. From here on, we can use any Java de-compiler to inspect the source code as shown in the below figure.

Figure 7: Java Decompiler

The first package in the JD-GUI (Java Decompiler) shows C2DM class which is Cloud to Device Messaging Framework. C2DM is a service which provides a simple and lightweight mechanism that helps an application developer send data from server to their applications. This service is usually used to do application updates, but can be also used for malicious purpose such as maintaining Command and Control (C&C) servers.

The second package carries more malicious code. Notice the code at startSendMessages() as shown in the above figure. As expected it is sending SMS to some numbers. But what is that number? And what is it trying to send? Lets’s probe further.

Figure 8: Building MCC Specific Text Message

While analyzing the program code, I noticed that the application is building certain texts messages, as shown in the figure: 8 above; based on an xml file stored in the resource folder. The code checks for certain country codes (ID) here such as Russian Federation (RF), Ukraine (UA), and Kazakhstan (KZ). It then sets the message depends on which country code identified. What if the country code is not from any of these lists? Here, anything apart from this country code will be set as Russian Federation by default.

When Android program gets compiled, all these resource files will get converted as binaries. Using the utility tool apktool, I decodeded everything back to original state. (Figure: 9).

Figure 9: Decoding using apktool

The converted xml file now looks like as shown below (figure 10). A Quick Google translator (to English) reveals it as installation operation message.

Figure 10: Analyzing Parsed XML

Further analyzing the Actor Class, I realized the application build Messages based on the Mobile Country Code (MCC) and the Mobile Network Code (MNC). The application validates mobile country code of Russian Federation (RF), Kazakhstan (KZ) and Ukraine (UA) and the corresponding Operator Code.

Table1: MCC used by the Application

The pseudo code looks like below:

The application schedules some tasks (figure 12) such as setting up an alarm for checking the purchase of the application. If it is purchased, it will send only one SMS to the premium number. It sets the initial alarm time as 300000000+systemtime (in milliseconds) which means 83.33 hour after the application gets installed for the first time in the device.

Figure 12: Initial Settings

As the application continues running as free version, the scheduler keeps checking the license and also keeps spying the stored messages (figure 14) to the preset number.

Figure 14: SMS Spying

Analyzing further (figure15) on the number revealed that it belongs to a Russian Company called PM-Invest Ltd. This website provides an online service for SMS fraud. They have a pool of premium numbers from which some can purchase one of them, and if any of the infected users send message to those numbers, the fraudulent will get a certain commission from PM-Invest Ltd for each SMS.

Figure 15: Premium Number Tacked

Henceforth, the malware cycle function as below:

1. Application gets access to the phone state and extracts MCC and MNC.
2. It then verifies and sets the corresponding premium number.
3. Builds the SMS format to be sent.
4. Checks the application’s license for verifying whether it is evaluation version or purchased one.
5. It checks for the application license every 50 seconds, and decrement the SMS count if it is purchased one and the license has renewed.
6. The application will send SMS to the premium number, once in every 83.33 hours.

The following figure was taken from the fraudulent website which shows their tariff plans and how their system works.

Figure 16: SMS Fraudulent Site Tariff

 Conclusion:

 The malware research analysis was done on the Android application to see the sophistication of real time malware writers and the application internals. Through the legitimate application markets are trying to clean all backdoor versions of application, it was observed that still some of the applications were able to carry malicious code despite all the efforts to plug the loopholes. This may attribute largely for Android because of its open and distributed development model. Following simple safeguards can help users to avoid such serious infections.

Safeguards and General Precautions

• Avoid downloading application from unknown 3rd party application stores
• Verify carefully what are the permission needed for each applications
• Download applications of legitimate authors, especially famous applications as they can be re-written by a malicious coder with an evil expectation of maximum infections.
• Use anti-malware/monitoring programs and keep them updated regularly.

 References:

1. APK Content:  http://en.wikipedia.org/wiki/APK_%28file_format%29
2. DalvikExecutable: http://source.android.com/tech/dalvik/dex-format.html
3. Server-side Polymorphism:  http://www.symantec.com/connect/blogs/server-side-polymorphic-android-applications
4. C2DM Framework:  https://developer.google.com/android/c2dm/
5. MCC & MNC:  http://mcclist.com/mobile-network-codes-country-codes.asp