Geost

#contacts Collects a list of all contacts from content://com.android.contacts/data/phones and sends to the C&C server.

An important method of MainService is processApiResponse(), which processes commands formatted as JSON string received from C&C server.

To maintain persistence across reboots, it registers for BOOT_COMPLETED and QUICKBOOT_POWERON broadcasts.

To maintain persistence across reboots, it registers for BOOT_COMPLETED and QUICKBOOT_POWERON broadcasts.

When the app was launched, it requested device administrator privileges. This was unusual since legitimate apps don’t often ask for this, as it basically gives an app complete rights over a device.

There were many pieces of evidence in the chat log showing a relationship with malware actions, such as asking to re-encrypt links because Kaspersky was able to detect them.

An algorithm was used to generate a random string for the C&C server URL. The API connection was then initialized, and the hostname of the C&C server was set up.

the Geost operation seems to consist of a large number of APK Android applications related to several topics, from banks and photo services, to fake social networks.

The emulator detector checks for signs that it’s running in an emulated environment. The sample detected the existence of Nox, Andy, Geny, Bluestacks and Qemu Android emulators.

It uses reflection code to hide interesting classes and methods from curious eyes. Basically, the first stage decrypted the second stage file with the same RC4 algorithm and key.

Important permissions that the user might unknowingly allow include those for accessing SMS messages, including confirmation messages from banking apps.

This service also collects information about running processes and tasks... #apps Collects list of installed package names and labels and sends to C&C server.

The emulator detector checks for signs that it’s running in an emulated environment. The sample detected the existence of Nox, Andy, Geny, Bluestacks and Qemu Android emulators.

The minimum amount of information that the botmasters know about each victim can be seen in the following list: IMEI of the phone Brand of the phone Phone service provider Phone number Country of the phone number

The ApiRequest, ApiResponse, and ApiInterfaceImpl classes enable communication with the C&C server... parameters for commands are appended as JSON format and converted to string.

The botmasters accessed the C&C servers through a web server using port 80/TCP.

The mistakes included: the use of the HtBot malware’s illegal proxy network

The first stage decrypted the second stage file... The aforementioned '.cache' file is renamed to .localsinfotimestamp1494987116 and saved after decryption as ydxwlab.jar, from which the .dex file is loaded and launched.

ClearServiceRunnable takes care of locking/unlocking commands (blocking/unblocking user activity) so the botnet operator can perform remote tasks without user intervention.

Domain generation algorithms (DGAs) are algorithms that generate domains in a pseudorandom way.

The DGA used in the Geost botnet is character-based, uses letters and numbers, and the TLD is .ru or .xyz.

#conversations Collects the address, body, date, and type columns from all SMS messages... and sends to the C&C server ... #contacts ... sends to the C&C server ... #calls ... sends to the C&C server.