GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → DefensiveLabAgency → FinSpy-for-Android

DefensiveLabAgency / FinSpy-for-Android

Licence: other
FinSpy for Android technical analysis and tools

Programming Languages

python
139335 projects - #7 most used programming language

Labels

androidreverse-engineeringmalware-analysisfinspy

Projects that are alternatives of or similar to FinSpy-for-Android

ssdc
ssdeep cluster analysis for malware files
Stars: ✭ 24 (-42.86%)
Mutual labels:  malware-analysis
Guanciale
🥓 Grab info needed by Carbonara from executables and disassemblers databases
Stars: ✭ 14 (-66.67%)
Mutual labels:  malware-analysis
learning-malware-analysis
This repository contains sample programs that mimick behavior found in real-world malware. The goal is to provide source code that can be compiled and used for learning purposes, without having to worry about handling live malware.
Stars: ✭ 124 (+195.24%)
Mutual labels:  malware-analysis
aparoid
Static and dynamic Android application security analysis
Stars: ✭ 62 (+47.62%)
Mutual labels:  malware-analysis
bonomen
BONOMEN - Hunt for Malware Critical Process Impersonation
Stars: ✭ 42 (+0%)
Mutual labels:  malware-analysis
toolkit
The essential toolkit for reversing, malware analysis, and cracking
Stars: ✭ 176 (+319.05%)
Mutual labels:  malware-analysis
angr-antievasion
Final project for the M.Sc. in Engineering in Computer Science at Università degli Studi di Roma "La Sapienza" (A.Y. 2016/2017).
Stars: ✭ 35 (-16.67%)
Mutual labels:  malware-analysis
malware-persistence
Collection of malware persistence and hunting information. Be a persistent persistence hunter!
Stars: ✭ 109 (+159.52%)
Mutual labels:  malware-analysis
assemblyline
AssemblyLine 4 - File triage and malware analysis
Stars: ✭ 69 (+64.29%)
Mutual labels:  malware-analysis
Malware-Sample-Sources
Malware Sample Sources
Stars: ✭ 214 (+409.52%)
Mutual labels:  malware-analysis
cheatsheet
These are some of the commands which I use frequently during Malware Analysis and DFIR.
Stars: ✭ 23 (-45.24%)
Mutual labels:  malware-analysis
awesome-executable-packing
A curated list of awesome resources related to executable packing
Stars: ✭ 720 (+1614.29%)
Mutual labels:  malware-analysis
telfhash
Symbol hash for ELF files
Stars: ✭ 75 (+78.57%)
Mutual labels:  malware-analysis
Malware-Zoo
Hashes of infamous malware
Stars: ✭ 18 (-57.14%)
Mutual labels:  malware-analysis
bluepill
BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)
Stars: ✭ 94 (+123.81%)
Mutual labels:  malware-analysis
kar98k public
pwn & ctf tools for windows
Stars: ✭ 24 (-42.86%)
Mutual labels:  malware-analysis
emerald
Import DynamoRIO drcov code coverage data into Ghidra
Stars: ✭ 30 (-28.57%)
Mutual labels:  malware-analysis
xLogger
Simple windows API logger
Stars: ✭ 62 (+47.62%)
Mutual labels:  malware-analysis
SuperLibrary
Information Security Library
Stars: ✭ 60 (+42.86%)
Mutual labels:  malware-analysis
assemblyline-core
Core server components for Assemblyline 4 (Alerter, dispatcher, expiry, ingester, scaler, updater, ...)
Stars: ✭ 16 (-61.9%)
Mutual labels:  malware-analysis
View All Similar Projects ➔

FinSpy for Android tools - 2020

This repository contains the tools we developed while investigating on a new FinSpy implant for Android as explained in the AmnestyTech report and our analysis report.

These tools are meant to:

  • extract and decode obfuscated strings;
  • extract and parse configuration whether it is stored into the APK or into the DEX.

FinSpy variants detection

We provide Yara rules (located at python/yara) detecting 4 variations of FinSpy for Android:

  • FinSpy_ConfigInAPK: FinSpy configuration stored into the APK
  • FinSpy_DexDen: FinSpy configuration stored into the DEX
  • FinSpy_TippyTime: use of a timestamp to generate local socket address
  • FinSpy_TippyPad: use of basic pad to obfuscate strings

Tools overview

  • java_parser.py extracts FinSpy_TippyPad obfuscated strings from Java source code
  • string_decoder.py decodes obfuscated strings
  • analyze_samples.py detects, extracts and parses FinSpy configuration of all samples stored in a given directory

NB: analyze_samples.py extracts and parses configuration whether it is stored into the APK or into the DEX.

Installation

  • clone this repository: git clone https://github.com/DefensiveLabAgency/FinSpy-for-Android.git
  • enter into the cloned directory: cd FinSpy-for-Android.git
  • create a Python 3 virtual env.: virtualenv -p python3 venv
  • activate the venv: source venv/bin/activate
  • then: cd python
  • install dependencies: pip install -r requirements.txt
  • play!

Configuration parsing

The scripts we provide parse what we were able to reverse so few configuration fields are not parsed. Anyway, if you run python analyze_samples.py ../samples yara/FinSpy.yar output, the script will generate the following directory structure:

  • output/
    • summary.txt an analysis summary report
    • <sample name>/
      • config.dat raw extracted configuration
      • config.hex hexdump of the extracted configuration
      • config.json JSON representation of the parsed configuration
      • config.txt text representation of the parsed configuration

Examples

Example of summary:

../samples/WIFI.apk
Matching Yara rules: [FinSpy_DexDen, FinSpy_TippyTime, FinSpy_TippyPad]
FinSpy configuration: found and extracted

../samples/9c8bf89d043ba3ed802d6d4f9b290747d12822402d61065adfbcb48a740a47b8.apk
Matching Yara rules: [FinSpy_DexDen, FinSpy_TippyTime, FinSpy_TippyPad]
FinSpy configuration: found and extracted

Example of parsed configuration:

[...]
[8402800][803770] TlvTypeConfigTargetProxy = 185.[redacted]
[8402800][803770] TlvTypeConfigTargetProxy = 103.[redacted]
[8403008][803840] TlvTypeConfigTargetPort = 443
[8676208][846370] TlvTypeConfigSMSPhoneNumber = +04[redacted]
[8676976][846670] TlvTypeMobileTrojanID = 12[redacted]
[8676672][846540] TlvTypeMobileTrojanUID = 22[redacted]
[16654656][fe2140] TlvTypeUserID = 1000
[8392000][800d40] TlvTypeTrojanMaxInfections = 9
[8677440][846840] TlvTypeConfigMobileAutoRemovalDateTime = 0
[8403776][803b40] TlvTypeConfigAutoRemovalIfNoProxy = 168
[8675472][846090] TlvTypeMobileTargetHeartbeatEvents = 
 - SIM changed: True
 - Cell location changed: False
 - Network changed: True
 - Call: False
 - Wifi connected: True
 - Data link available: True
 - Network activated: False
 - Data available: True
[8681872][847990] TlvTypeInstalledModules = 
 - Spy calls: False
 - Intercept calls: False
 - SMS: True
 - Address book: True
 - Logging: False
 - Location: True
 - Call log: True
 - Calendar: True
 - Spy chats: True
[...]

Credits

  • Esther Onfroy
  • Etienne Maynier
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].