{"id":464,"date":"2016-03-18T15:05:32","date_gmt":"2016-03-18T23:05:32","guid":{"rendered":"https:\/\/www.pnfsoftware.com\/blog\/?p=464"},"modified":"2018-12-19T13:37:16","modified_gmt":"2018-12-19T21:37:16","slug":"deobfuscating-android-triada-malware","status":"publish","type":"post","link":"https:\/\/www.pnfsoftware.com\/blog\/deobfuscating-android-triada-malware\/","title":{"rendered":"Deobfuscating Android Triada malware"},"content":{"rendered":"

The Triada malware<\/a>\u00a0has received a lot of news coverage recently. Kaspersky was one of the first firm to publish an analysis of this Trojan<\/a> earlier last week.<\/p>\n

The code is obfuscated, and most strings are encrypted. The string encryption algorithm is trivial, but ever-changing across classes: bytes are incremented or decremented by constant values, either stored in a default decryptor method, or retrieved via calls to other methods. The result is something quite annoying to handle if you decide to perform a serious static analysis of the file.<\/p>\n

\"\"<\/a>
Encrypted string buffers in Triada. Decryption routines can be seen in the decompiled class on the right-hand side.<\/figcaption><\/figure>\n

Our intern Ruoxiao Wang wrote\u00a0a very handy decryption script<\/a> for Triada. It needs customizing (the decryption keys are not automatically retrieved) on a per-class basis, but the overall effort is a couple of seconds versus hours spending doing tedious and repetitive semi-manual work.<\/p>\n

The script will decrypt the encrypted\u00a0byte arrays\u00a0and replace the decompiled Java fields supposedly holding the final strings by their actual value, as seen in the picture below.<\/p>\n

\"\"<\/a>
Decrypted strings. Comments (in the left-side red box) indicate the string use was not found via xrefs. The right-side red box shows updated String fields after decryption.<\/figcaption><\/figure>\n

The script can also be used as a tutorial on how to use the JEB Java AST API<\/a>\u00a0to look for and modify the AST of decompiled code. \u00a0(More examples\u00a0be seen on our GitHub sample script repo.<\/a>)<\/p>\n

Download the Triada decryptor script here:
\nTriadaStringDecryptor.py<\/a><\/strong><\/p>\n

(Specific instructions are located in the script header.)<\/p>\n","protected":false},"excerpt":{"rendered":"

The Triada malware\u00a0has received a lot of news coverage recently. Kaspersky was one of the first firm to publish an analysis of this Trojan earlier last week. The code is obfuscated, and most strings are encrypted. The string encryption algorithm is trivial, but ever-changing across classes: bytes are incremented or decremented by constant values, either … Continue reading Deobfuscating Android Triada malware<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,9,8,2],"tags":[],"class_list":["post-464","post","type-post","status-publish","format-standard","hentry","category-android","category-api-jeb2","category-jeb2","category-malware"],"_links":{"self":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/posts\/464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/comments?post=464"}],"version-history":[{"count":0,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/posts\/464\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/media?parent=464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/categories?post=464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pnfsoftware.com\/blog\/wp-json\/wp\/v2\/tags?post=464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}