Tracking down hidden malware on Android

I've always heard stories about nasty Android malware that throws full-screen advertisements at inopportune times, but I'd never seen it myself until a family member handed me their Galaxy Note 5. The malware certainly exits, it triggers in any application and shows a full-screen advertisement, probably in a WebView. The recent applications list shows no identifying marks, and trying to switch to it just returns to the home screen. Figuring this one out is going to require adb.

As a first attempt, I tried to watch adb logcat while using the phone to see which activity was getting focus. This produced way too much output for anything interesting to be noticeable. After some poking around with top and ls, I decided to try asking for the window with focus directly using dumpsys window windows | grep -E 'mCurrentFocus|mFocusedApp' and got back the extremely surprising result of

mCurrentFocus=Window{2e181dbf u0 d0 com.android.panel.settings/a.b.c.d.Boost}

which made no sense to me, as anything under com.android should be part of the system, but a.b.c.d.Boost was extremely suspicious, especially as it had no reasonable Google search results. Looking for the app with pm list packages -f, I found the full path of the installed malware, package:/data/app/com.android.panel.settings-1/base.apk=com.android.panel.settings, which proved it's not a core system application, but something that was installed after-the-fact as it was in /data. I pulled the base.apk file to my laptop for analysis, and uninstalled the application with pm uninstall com.android.panel.settings.

Now that the phone was clean, I tried to trigger the malware and could no longer do so. Great! Time for analysis. Using apktool, I decompiled the application and looked for interesting strings. Sure enough, a.b.c.d.Boost was the main entry point of the application, and it contained a WebView. I read through some of the smali-decompiled source to see what else the application was doing, and cross-referenced it with the manifest and resources. It seems the application listens for a variety of system intents, like WiFi status changing, or battery level notifications, and uses that to trigger the advertisement. That's consistent with my experience trying to get the ads to come up---the more power you draw (e.g., playing a game) the more frequently you get an ad.

The most interesting data was in res/values/strings.xml, which identifies the malware authors:

<string name="adv_key">ZWMwMDBhMDBjZTAwMDJlNDAwMDAwMmY1MDAwMmY1MDAwMmY1NDkxOWQzZGI0Nw==</string>

<string name="app_name">Music Player</string>

<string name="app_name_ex">Panel Settings</string>

<string name="url_part">http://setup.phoneadsmobile.net</string>

<string name="url_part1">http://setup.phoneadsmobile.net</string>

</resources>

I've submitted the file to VirusTotal to cross-reference my findings. This adware/malware is particularly sneaky, disguising itself as part of the Android System, making it hard to identify and remove. None of the mobile antivirus products I tried identified the issue, and identification on the VirusTotal database is also fairly low. Suspicious behavior is always worth looking into, especially when the automated tools fail; adb and friends are good things to have in your toolbox.