diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md index 4a56d6a69b9..03879df3e1d 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/android-malware-post-exploitation.md @@ -34,10 +34,18 @@ Phishing pages and droppers now ship step-by-step UI instructions to allow restr Triage hint: in a dropper, grep for `PackageInstaller.createSession/openSession` plus code that immediately navigates the victim to `ACTION_ACCESSIBILITY_SETTINGS` or `ACTION_NOTIFICATION_LISTENER_SETTINGS`. +### Default-Home role as installer workflow persistence + +A dropper can register a Home activity, prompt the victim to make it the **default launcher**, and render its remaining consent/install steps as local HTML. Every HOME press then reopens the attacker's workflow instead of the normal launcher. After the child payload gains Accessibility, the dropper can relinquish the Home role to restore normal behaviour and reduce suspicion.[[24]](#references) + +During triage, correlate a Home intent filter (`ACTION_MAIN` + `CATEGORY_HOME` + `CATEGORY_DEFAULT`) or `ROLE_HOME` request with WebView-hosted setup pages, `PackageInstaller` sessions, polling of enabled Accessibility services, and code that later clears or replaces the preferred Home activity.[[24]](#references) + ### Selective `VpnService` blackhole as installation coercion Some droppers briefly request a legitimate Android VPN, exclude the attacker-controlled packages from the tunnel, install default IPv4/IPv6 routes, and then simply **stop forwarding packets**.[[15]](#references) The malware keeps its own connectivity while most victim apps appear offline, pushing the user back into the setup flow to finish unknown-source install, Accessibility, or role prompts. +The outage can also create an **anti-cloud-analysis window**: exclude only the dropper so it can fetch and install the child APK while cloud-backed security/reputation clients cannot submit it or obtain a verdict. The dropper stops the VPN after launching the payload so C2 traffic resumes. This only interferes with online checks; cached/offline signatures may still detect the package.[[24]](#references) + Practical pattern: 1. `VpnService.prepare()` or an equivalent prompt is shown during the lure flow. @@ -723,6 +731,8 @@ Common flow: This design makes the overlay set remotely updateable without shipping a new APK and leaves very specific forensic artifacts: tables or rows storing the package name, enable/disable status, and phishing URL / HTML blob. +A more ephemeral variant reports each foreground-package change to the C2, writes the returned HTML as `injections/.html`, loads it in a JavaScript-enabled WebView with a native bridge used to return form data, and deletes the file after loading. Correlate foreground-app monitoring, short-lived per-package HTML files, `setJavaScriptEnabled(true)`, `addJavascriptInterface()`, and bridge methods that close the activity after submitting captured values.[[24]](#references) + ### Semantic Accessibility parsing for app-specific theft Instead of exfiltrating the whole UI tree blindly, some samples treat Accessibility as a **semantic screen classifier**. They ignore common labels that belong to the target app's normal chrome and focus only on text that is likely to be sensitive. @@ -745,6 +755,12 @@ Not every Android RAT uses continuous `MediaProjection` streaming. A quieter alt For analysts, this matters because the malware may provide operator screen visibility **without** requesting the visible MediaProjection consent flow. Hunt for repeated screenshot helpers, `Bitmap.compress(...)`, PNG encoders, timer/handler loops, and upload routines that send image blobs plus timestamps. +### Changed-frame screenshot and UI-tree streaming + +Bandwidth-efficient RATs can scale screenshots, encode them as lossy WebP, and send a frame only when a fast checksum such as Adler-32 differs from the preceding frame. `MediaProjection.createVirtualDisplay()` with an `ImageReader` provides a conventional screen stream but may expose a system sharing indicator; repeated `AccessibilityService.takeScreenshot()` calls provide a less conspicuous alternative on supported Android versions.[[24]](#references) + +The same change-only strategy works without pixels: serialize the current `AccessibilityNodeInfo` tree (text, bounds, actions, and identifiers) to JSON, checksum the serialization, and suppress identical trees. This produces a low-bandwidth interactive model that still gives an operator control labels and coordinates. Hunt for `takeScreenshot()`, `createVirtualDisplay()`, `ImageReader`, `Bitmap.CompressFormat.WEBP_LOSSY` / `WEBP_LOSSLESS`, `Adler32`, recursive node traversal, and WebSocket messages carrying image or tree blobs.[[24]](#references) + ### Dynamic C2 rotation and security-tool suppression Two small but useful patterns: @@ -960,5 +976,6 @@ Separating these channels can keep UI automation responsive while heavier screen - [21] [Octagon: Technical Analysis of a Fake Bahrain Civil Defense Application](https://labs.k7computing.com/index.php/octagon-technical-analysis-of-a-fake-bahrain-civil-defense-application/) - [22] [Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan (ESET Research)](https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/) - [23] [New Android Malware Herodotus Mimics Human Behaviour to Evade Detection (ThreatFabric)](https://www.threatfabric.com/blogs/new-android-malware-herodotus-mimics-human-behaviour-to-evade-detection) +- [24] [Uncovering StreamRat: From Meta Ads to Full Device Takeover](https://threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat) {{#include ../../banners/hacktricks-training.md}}