It seems smartphone malware authors are diligent and hard-working to protect their own "intellectual property" -- malware by evolving/bringing them to the next level. After discovering the original DroidKungFu malware in June and its DroidKungFu2 variant in July, our research team, in collaboration with NQ Mobile, recently identified a new wave of DroidKungFu-infected apps this August. The new variant or DroidKungFu3 is much more "advanced" than previous versions -- as it is clearly designed to evade the detection from existing mobile anti-virus software. More specifically, this variant is equipped with new protection mechanisms by (1) obfuscating remote C&C server URLs (instead of including them as plaintext in earlier versions); (2) hiding all malware-related native binaries with encryption; and (3) masquerading an embedded app as the official Google Update. These obfuscation mechanisms as well as various differences from earlier versions are a clear sign behind the rapid evoluation of Android malware.
Once installed on the phone, this DroidKungFu variant will "phone home" with various
information collected from the device, including IMEI, OS version number, and phone model.
Specifically, instead of including plaintex remote server URLs, the malware encrypts them
and has three C&C servers for additional redundancy or robustness. The following figures
show the uncovered URLs of the C&C server as well as the decryption method used in the DroidKungFu variant.
Similar to the earlier variants, this new version also carries with two root exploits.
To avoid being detected, these root exploits are encypted. Our analysis shows that one
of them is the well-known "RageAgainstTheCage" root exploit and the other exploits
the adb resource exhaustion bug, which affects Android 2.2 or below (NOTE: more than
85% of Android device runs on Android 2.2 and Android 2.1). If successful, the malware
can elevate its privilege to root. Recent Android versions (2.3+) have patched these bugs
and these two exploits will not be successful. In this case, the malware will attempt
to detect whether the phone has been already rooted and if so further request for the
root privilege. In either way, the malware will still phone home with collected phone
information (e.g., IMEI and phone model etc).
Inside the infected app, there exists an (encrypted) embedded apk that the malware will attempt
to install after getting the root privilege. Specifically, the embedded apk, once decrypted,
appears to be a fake Google Update app. If installed, this embedded apk does not show any
icon in the home screen. Our analysis shows that this app is actually a backdoor, which will connect
back to a remote server for instructions. In essence, it effectively converts the compromised
phone into a bot.
Within a short two-month period from June to August 2011, we have already identified three different versions
of DroidKungFu malware.
Clearly, while the anti-virus companies diligently push out signatures to detect
malware in the wild, the malware authors are also working hard to evolve malware
at a rapid pace to avoid detection. Considering the current pace the malware is
evolving, we anticipate the arm race will be observed to be more intense in the
future.
The following table lists the key differences we observed among these three variants of
DroidKungFu malware: DroidKungFu1 is the very first
DroidKungFu sample we discovered in June, 2011.
DroidKungFu2 is the second variant we detected in July, 2011. DroidKung3
is the most recent one we are reporting in this article.
It is evident from the table that DroidKungFu malware is evolving in multiple aspects.
For example, the first version DroidKungFu1 includes one (and only one) C&C server hardcoded in Java code
as plaintext; the second version DroidKungFu2 evolves it by having three C&C servers and including
them
in native code, which makes it diffuclt for reverse engineering analysis.
The current version DroidKungFu3 makes a step further by encrypting them instead of simply
including them as plaintext. It is also worth noting the time line of these variants. In particular,
though new signatures are timley pushed out to protect users, malware authors are also diligently
releasing new variant (one per month in this case) to evade the detection. Our experiments
show that each new variant of DroidKungFu malware can successfully evade the detection by
most, if not all, leading (full-patched) mobile anti-virus softwares at the time we discover it.
Last modified: August 17th, 2011