The Latest in IT Security

We were recently able to analyze the routines of the latest DroidKungFu variant, detected as ANDROIDOS_KUNGFU.CI. While we were monitoring the traffic between ANDROIDOS_KUNGFU.CI and its remote server, we chanced upon a command to delete a certain package.

I did some research on the package, and found that the deleted package is a new DroidDreamLight variant. The DroidDreamLight family is known to show notifications as part of its social engineering routine. This is to trick the user into clicking on the notifications to download new component, or update itself.

This particular DroidDreamLight variant, detected as ANDROIDOS_DORDRAE.O, starts its service (called ‘SystemConfService’) when the device boots up or receives/makes a call. It uploads the same information as its previous incarnations.

I wanted to see the notifications created by the malware for myself so I tested it by creating a web server and making the malware connect to it by changing the emulator network setting. Based on my analysis of the code, the malware expects an XML from the server with the following sample format:

• Update

This notification updates the current malware package. When the user clicks on the update notification, the device shows a dialog box asking the user if he/she wants to replace the current app. If the user clicks “OK,” the installation continues. The package to be installed is already pre-downloaded by the malware before showing the notification.

• Download – When the user clicks the download notification, it will download the file specified by the malware server.
• Market – When the user clicks the market notification, the malware will view the Android Market page for the package specified by the server.
• Web – When the user clicks the web notification, the malware will connect to the URL specified by the server.

Below are sample notifications from the malware. Of course, the malware server will put different titles and descriptions (probably with a social engineering twist to it), and will not send the notifications at the same time to avoid suspicion.