BadPack Malware for Android Infects APK Installers

New research reveals a novel approach to hiding malware in APK installers. Adversaries manipulate the file header to circumvent protection and make analysis much more difficult. The peak usage of this trick occurred in May 2024, but it has not completely disappeared and could resurge at any time.

BADPACK MALWARE

The detailed paper on BadPack malware reveals an unusual tactic for evading analysis. Attackers manipulate the internals of APK files, rendering debug and reverse engineering tools ineffective and blocking real-time analysis. Despite these modifications, the file retains its ZIP archive capabilities, carrying a set of compressed files that remain intact and ready for the attack.

The key element here is the AndroidManifest.xml file, crucial for running any APK on Android. It provides the system with execution instructions.

Malicious actors modify their APK files to prevent the correct extraction of the Android Manifest, effectively blocking most security tools from detecting the attack.

Fraudsters manipulate compression methods that describe how the archive is composed. By misreporting compression options or omitting file sizes, they can evade detection while the operating system still executes the file as if it’s legitimate.

This design flaw in the Android runtime mechanism is concerning. The strict file checks in many analysis tools cause them to fail to process the malicious file.

An example of a malformed file header

The discovery of BadPack malware is concerning, and PaloAlto’s Unit42 has thoroughly detailed the attack. This issue undermines typical Android security measures. Uploading the APK to online scanners or using local ones to inspect the code will only result in clean reports or errors, misleading users into thinking the file is safe.

The threat posed by this technique is significant, as it allows cybercriminals to evade detection. Android remains a primary target, with many malware families specifically designed for this OS. These often include backdoors that create botnets for DDoS attacks or crypto mining.

For personal devices, spyware is a common threat, often found in sketchy APK files from third-party sites. With BadPack, detecting the threat before it’s too late becomes nearly impossible.

How to Protect Your Smartphone

1. Install Trusted Apps Only:
   • Google Play Store: Only download apps from reputable sources like the Google Play Store.
   • Avoid Third-Party Sites: Steer clear of downloading APKs from unknown or unofficial sites.
2. Keep Your Software Updated:
   • OS Updates: Regularly update your phone’s operating system to the latest version.
   • App Updates: Ensure all your apps are updated to their latest versions for better security patches.
3. Use Strong Security Solutions:
   • Antivirus Apps: Install a reputable mobile antivirus app to help detect and remove malware.
   • Security Features: Utilize built-in security features like Google Play Protect.
4. Be Cautious with Permissions:
   • Review App Permissions: Only grant necessary permissions to apps. Be wary of apps requesting excessive permissions.
   • Manage Permissions: Regularly review and manage app permissions in your phone’s settings.
5. Avoid Phishing Scams:
   • Suspicious Links: Don’t click on suspicious links in emails, texts, or social media messages.
   • Verify Sources: Always verify the source before downloading attachments or providing personal information.
6. Regular Backups:
   • Cloud Services: Use cloud services to back up your important data.
   • Local Backups: Regularly create local backups on your computer or an external storage device.
7. Enable Find My Device:
   • Track Your Phone: Enable features like Find My Device to track, lock, or erase your phone if it’s lost or stolen.
8. Use Strong Authentication:
   • Passwords and PINs: Use strong, unique passwords or PINs for your device and accounts.
   • Biometric Security: Utilize fingerprint or facial recognition for added security.
9. Be Mindful of Public Wi-Fi:
   • Avoid Sensitive Transactions: Don’t perform sensitive transactions over public Wi-Fi.
   • Use VPN: Use a virtual private network (VPN) to secure your internet connection when using public networks.
10. Regularly Review Security Settings:
    • Phone Settings: Periodically review your phone’s security settings to ensure optimal protection.
    • App Settings: Check individual app settings for any security features you can enable.

By following these steps, you can significantly enhance the security of your smartphone and protect it from potential threats.

Indicators of Compromise

SHA256 hashes of BadPack malware samples:

• 0003445778b525bcb9d86b1651af6760da7a8f54a1d001c355a5d3ad915c94cb
• 015bd2e799049f5e474b80cbbdcd592ce4e2dfbfae183bada86a9b6ec103e25e
• 131135a7c911bd45db8801ca336fc051246280c90ae5dafc33e68499d8514761
• 90c41e52f5ac57b8bd056313063acadc753d44fb97c45c2dc58d4972fe9f9f21

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!