• Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg
  • Delicious

Anti-Malware Laboratory

Yet Another Malware Blog

About

An informal blog from your friendly neighborhood software security humans.

Blog Archive

  • ▼  2015 (5)
    • ▼  October (1)
      • Another Macro Script Technique in Executing Malware
    • ►  August (2)
    • ►  May (1)
    • ►  March (1)
  • ►  2014 (8)
    • ►  October (1)
    • ►  July (1)
    • ►  June (1)
    • ►  May (4)
    • ►  April (1)
  • ►  2013 (12)
    • ►  December (3)
    • ►  November (5)
    • ►  August (2)
    • ►  March (2)
  • ►  2012 (35)
    • ►  April (4)
    • ►  March (12)
    • ►  February (17)
    • ►  January (2)

Categories

adobe (1) android (10) android february (1) baksmali (1) Black Hole (2) crimepack (1) disassembler (1) exploit (3) Exploits (4) Fakeav Winrar sfx (1) Fishbowl (1) flash (1) gift certificates (1) Google Authenticator (1) google play (1) hcp (1) java (1) Malware (5) mdac (1) Mobile (24) NSA Mobility Program (1) obfuscated script (1) pdf (1) Reversing (2) rhino (1) skype (1) smali (1) spam (1) test (1) Unpacking (1) vouchers (1) vulnerability (3)

Popular Posts

  • Bank of America spam: An Analysis
    An email claiming to be from Bank of America lures users to open an attachment that shows how to open secure emails from the bank. The mess...
  • [BE CAUTIOUS] Dragon Ball Z: Resurrection of F MALWARE and SCAM
    Be wary of downloading movies in torrent sites.  Executables can also be executed with a file size as huge as a gigabyte...
  • Unpacking MFC Compiled CryptoWall Malware
    Unpacking MFC Compiled CryptoWall Malware Introduction First and foremost, this article does not intend to analyze what CryptoWall malw...

Visitors to this blog

Showing posts with label Mobile. Show all posts
Showing posts with label Mobile. Show all posts

Wednesday, April 4, 2012

Android Malware March 2012 Roundup

Posted on Wednesday, April 04, 2012 by Red Horse | No comments
 Originally posted by elmo.
Date Name
Mar 14, 2012 Faketoken
Mar 15, 2012 Boxer
Mar 20, 2012 Antammi
Mar 22, 2012 TGLoader
Mar 29, 2012 DKFBootKit
Read More

Google Authenticator updated

Posted on Wednesday, April 04, 2012 by Red Horse | No comments
Originally posted by elmo.

Google recently updated Google Authenticator to version 2.15.

What's in this version:
1. New entry for Google Play, same great app
2. Updated look and feel
3. "Scan barcode" and "Manually add account" options moved to Menu > Add account.

When your phone is not connected to any network, Google Authenticator can be used to generate a valid verification code.

The verification code generated is then used in Google's 2-step verification process when signing in from a new device or phone.

Please visit this site for more info.

[gallery]
Read More

Monday, March 19, 2012

The 2012 Cyber Defence University Challenge

Posted on Monday, March 19, 2012 by Red Horse | No comments
Originally posted by elmo.

To raise awareness in cyber security, the Australian government in partnership with Australian universities  and Telstra challenges university undergraduates to join in the Challenge.

The Challenge is 24 hour competition related to security and will start on April 3 and end on April 4, 2012.

The winner will have the opportunity to travel to Las Vegas, USA in July 2012 to join in Black Hat's 2012 Conference.

For more info, you may visit this site.
Read More

Tuesday, March 6, 2012

AXMLPrinter2

Posted on Tuesday, March 06, 2012 by Red Horse | No comments
Originally posted by elmo.

AXMLPrinter2 or AXMLPrinter version 2 is a tool that uses AXmlResourceParser to convert a binary xml file to readable xml document.

Prerequisite:
JDK (java development kit) needs to be installed in your system.

Download:
AXMLPrinter2.jar

Syntax:
1. go to the folder where you downloaded AXMLPrinter2
2. open a command prompt
3. type and execute "java -jar AXMLPrinter2.jar <location of xml file> >> <ouput file>"
e.g. d:\tools>java -jar AXMLPrinter2.jar d:\test\AndroidManifest.xml >> out.log
4. open <output file> or out.log
Read More

Friday, March 2, 2012

Installing Ubuntu 10.04.1 LTS 64 bit, MongoDB 2.0.3, Lamp, and RockMongo

Posted on Friday, March 02, 2012 by Red Horse | 1 comment
Originally posted by elmo.

1. Installing Ubuntu 10.04.1 LTS 64-bit

1.1 go to ubuntu download page
1.2 select Ubuntu 10.04 LTS
1.3 select 64-bit
1.4 then click Start download (you will download an iso image)
1.5 burn iso image to disc
1.6 install Ubuntu using disc


Notes:

We have selected 64-bit as MongoDB only supports 2 GB of data for 32-bit builds.

Another cool ubuntu installer is Wubi or Windows Ubuntu Installer which will allow you to install in Windows and dual boot.

To check if you are running 32-bit or 64-bit type "uname -m".
i686 for 32-bit
x64_64 for 64-bit


2. Installing Mongodb 2.0.3

2.1 go to MongoDb download page
2.2 click download under Linux 64-bit or "wget http://fastdl.mongodb.org/linux/mongodb-linux-x86_64-2.0.1.tgz"
2.3 unzip using "tar xzf mongodb-linux-x86_64-2.0.1.tgz"
2.4 move folder using "sudo mv mongodb-linux-x86_64-2.0.1 ~"
2.5 create data directory "sudo mkdir /data"
2.6 create db directory "sudo mkdir /data/db"
2.7 change permission "sudo chmod 777 /data/*"
2.8 go to mongo bin directory "cd ~/mongodb-linux-x86_64-2.0.1/bin"
2.9 start mongo server "./mongod"
2.10 "./mongo"


3. Installing LAMP - Apache, MySQL, PHP on Ubuntu

3.1 install tasksel "sudo apt-get install tasksel"
3.2 install LAMP stack "sudo tasksel install lamp-server"


4. Installing Rockmongo

4.1 install PEAR and development version of php "apt-get install php-pear php5-dev"
4.2 install driver for php mongodb "pecl install mongo"
4.3 configure php "nano /etc/php5/conf.d/mongodb.ini"

;----- start -----
extension=mongo.so
\[mongo\]
; If the driver should reconnect to mongo
mongo.auto_reconnect = true
; Whether to allow persistent connections
mongo.allow_persistent = On
; Maximum number of persistent connections (-1 means unlimited)
mongo.max_persistent = -1
; Maximum number of links (persistent and non-persistent, -1 means unlimited)
mongo.max_connections = -1
; Default host for mongo connection
mongo.default_host = www.example.com
; Default port for mongo database
mongo.default_port = 42
; When saving files to the database, size of chunks to split them into
mongo.chunk_size = 1024
; Specify an alternate character to $ to use for special db functions ($set, $push, $exists, etc.)

mongo.cmd = "$"
;----- end -----

4.4 restart apache "/etc/init.d/apache2 restart"
4.5 download rockmongo-v1.1.0.zip
4.6 unzip to "rockmongo" folder and move folder to /var/www
4.7 open a browser and type http://localhost/rockmongo/index.php
4.8 login using admin as username and password
Read More

Thursday, March 1, 2012

Baksmali

Posted on Thursday, March 01, 2012 by Red Horse | No comments
Originally posted by elmo.
Baksmali means disassembler in Icelandic language and it is used to dissassemble a dex file.

Prerequisite:
JDK (java development kit) needs to be installed in your system.

Download:
baksmali-x.x.x.jar

Syntax:
1. go to the folder where you downloaded baksmali
2. open a command prompt
3. type and execute "java -jar baksmali-x.x.x.jar <location of dex file>"
e.g. d:\tools>java -jar baksmali-1.3.2.jar d:\test\classes.dex
4. the dissassembled file is located in the "out" folder located in the baksmali directory
Read More

Wednesday, February 29, 2012

Ubuntu for Android

Posted on Wednesday, February 29, 2012 by Red Horse | No comments
Originally posted by elmo.
ubuntu4android2
Reference:
Ubuntu
Read More

Android Malware February 2012 Roundup

Posted on Wednesday, February 29, 2012 by Red Horse | No comments
Originally posted by elmo.

Date
Name
Feb 03, 2012 RootSmart
Feb 06, 2012 FakeRun
Feb 13, 2012 PushBot
Feb 14, 2012 FakeClick
Feb 15, 2012 Gappusin
Feb 17, 2012 Loicdos
Feb 20, 2012 LeadBolt
Feb 23, 2012 Fakeapp
Feb 23, 2012 Opfake.B
Feb 25, 2012 FakeAngry
Feb 25, 2012 Moghava
Read More

Wednesday, February 22, 2012

Bouncer

Posted on Wednesday, February 22, 2012 by Red Horse | 1 comment
Originally posted by elmo.

Google has developed a service called Bouncer which automatically scans the official Android Market for Potentially Unwanted Programs or PUP.

Bouncer will perform the following services:
1. scans the uploaded app against known malwares and spywares.
2. use behavioral scanning to check for known malicious behavior.
3. check new developer account and prevent repeat-offending account from uploading apps.
Read More

Friday, February 17, 2012

Foncy

Posted on Friday, February 17, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery]
Read More

FakeTimer

Posted on Friday, February 17, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery link="file" order="DESC"]
Read More

RootSmart

Posted on Friday, February 17, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery link="file" order="DESC"]
Read More

Wednesday, February 15, 2012

Smspacem

Posted on Wednesday, February 15, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery]
Read More

Fakeplayer

Posted on Wednesday, February 15, 2012 by Red Horse | No comments
Originally posted by elmo.
Read More

Thursday, February 9, 2012

Android History

Posted on Thursday, February 09, 2012 by Red Horse | No comments
Originally posted by elmo.
A compressed android history.



Source:
Wikipedia
Read More

Wednesday, February 8, 2012

Android Malware History

Posted on Wednesday, February 08, 2012 by Red Horse | No comments
Originally posted by elmo.


Date
Name
Aug 10, 2010 FakePlayer.a
Aug 12, 2010 TapSnake
Sep 09, 2010 FakePlayer.b
Oct 13, 2010 FakePlayer.c
Nov 12, 2010 SMS Replicator Secret
Dec 29, 2010 Geinimi
Feb 14, 2011 Adrd 
Feb 22, 2011 Pjapps
Mar 01, 2011 DroidDream
Mar 04, 2011 BgServ
Mar 20, 2011 zHash
Mar 31, 2011 Walkinwat
May 07, 2011 Adsms
May 11, 2011 Zsone
May 22, 2011 Smspacem
May 30, 2011 DroidDreamLight
May 23, 2011 BaseBridge
May 31, 2011 Zitmo
May 31, 2011 DroidKungFu
Jun 05, 2011 Plankton 
Jun 07, 2011 YZHCSMS
Jun 15, 2011 jSMSHider
Jun 20, 2011 GGTracker
Jun 29, 2011 DroidKungFu2
Jul 01, 2011 GoldDream
Jul 03, 2011 Crusewind
Jul 04, 2011 SndApps
Jul 08, 2011 DroidDream variant
Jul 10, 2011 HippoSMS 
Jul 15, 2011 Fokonge
Jul 15, 2011 Mobilespy
Jul 20, 2011 GamblerSMS
Jul 28, 2011 Lovetrap
Jul 30, 2011 Ewalls
Jul 31, 2011 NickiSpy
Aug 01, 2011 Netisend
Aug 02, 2011 Premiumtext
Aug 04, 2011 Pirates
Aug 12, 2011 RogueSPPush
Aug 15, 2011 Dogowar
Aug 15, 2011 DroidKungFu3
Aug 18, 2011 GingerMaster
Aug 23, 2011 Gmaster
Sep 01, 2011 Goldeneagle
Sep 01, 2011 DroidDeluxe
Sep 12, 2011 DroidCoupon 
Sep 13, 2011 Spitmo
Sep 14, 2011 Ozotshielder
Sep 15, 2011 AnserverBot
Sep 29, 2011 Gonesixty
Sep 29, 2011 FakeBrows
Oct 10, 2011 Fakeneflic
Oct 10, 2011 BeanBot 
Oct 11, 2011 RogueLemon
Oct 17, 2011 Batterydoctor
Oct 20, 2011 DroidKungFu variant
Nov 02, 2011 SMSReplicator
Nov 04, 2011 Fakemini
Nov 05, 2011 DroidLive
Nov 12, 2011 Positmob
Nov 15, 2011 Fauxtocopy
Nov 15, 2011 Lifemonspy
Nov 15, 2011 Mobinaspy
Nov 16, 2011 Cobblerone
Nov 16, 2011 Meswatcherbox
Nov 16, 2011 Pdaspy
Nov 16, 2011 Cellshark
Nov 21, 2011 DroidKungFuSapp 
Nov 23, 2011 Fjcon
Nov 25, 2011 Foncy
Dec 12, 2011 Rufraud
Dec 19, 2011 Arspam
Dec 19, 2011 Spybubble
Dec 20, 2011 Flexispy
Dec 20, 2011 Kidlogger
Jan 05, 2012 Nyearleaker
Jan 09, 2012 Steek
Jan 09, 2012 Qicsomos
Jan 10, 2012 FakeTimer
Jan 10, 2012 Fakenotify
Jan 13, 2012 FoncySMS
Jan 27, 2012 Counterclank
Feb 03, 2012 RootSmart
Feb 06, 2012 FakeRun
Feb 13, 2012 PushBot
Feb 14, 2012 FakeClick
Feb 15, 2012 Gappusin
Feb 17, 2012 Loicdos
Feb 20, 2012 LeadBolt

References:
Paolo Passeri
McAfee
Lookout
Symantec
Trend Micro
Mila Parkour
Read More

Friday, February 3, 2012

Android User Protection Strategies

Posted on Friday, February 03, 2012 by Red Horse | 1 comment
Originally posted by elmo.

1. install apps from trusted source

2. check comments

3. check permissions

4. install android antivirus
Read More

Dogowar

Posted on Friday, February 03, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery]
Read More

ShastroSms

Posted on Friday, February 03, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery order="DESC"]
Read More

Installing Android APK

Posted on Friday, February 03, 2012 by Red Horse | No comments
Originally posted by elmo.
[gallery]

1. download, install and update android sdk from google
http://developer.android.com/sdk/index.html

2. download and install jdk (java development kit) from oracle
http://www.oracle.com/technetwork/java/javase/downloads/index.html

3. go to "C:\Program Files\Android\android-sdk"

4. run AVD Manager.exe

5. create new AVD (android virtual device)

6. launch the AVD created.

6. go to C:\Program Files\Android\android-sdk\platform-tools

7. run "adb install [path].apk"
example: adb install fruitninja.apk
output:
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
66 KB/s (1667798 bytes in 24.655s)
pkg: /data/local/tmp/fruitninja.apk
Success
Read More
Older Posts Home
Subscribe to: Posts (Atom)
volute-glacial
volute-glacial
volute-glacial
volute-glacial
Copyright © Anti-Malware Laboratory | Powered by Blogger
Design by Fabthemes | Blogger Template by NewBloggerThemes.com