Download File Firmware and Flashtool plus Video Tutorial compressed:
do not forget there are some additional tips from me:
How To Flashing okapia elite
hello everyone, today we're actually taking a look at some android malware but before we get to that, i actually want to give a quick shoutout to my friend siraj who actually alerted me to this and let me know that it existed. now i've been good friends with siraj for many years, dating back to my freshman year of high school so since 2005, i've known this guy. we've been good friends since then. but now, he has this very in depth, very informative youtube channel dealing with computer science and machine learning, sort of advanced programming techniques to make a machine learn as in programming. so, if that's something you'd think would interest you, certainly interests me, i'd suggest you'd go check it out, and follow the annotation on the screen or check out the link in the description.
so, siraj suggested i take a look at this malware called "elite" now this is actually for android, and from an overview, its relatively simplistic, i mean my friend rogueamp has looked at some ransomware for android, now thats pretty cool, you know, locking yourself out of everything on your phone and demanding payment to get back into it. however, this goes the more sort of "old school" route. right away, it starts sending sms messages from your account until your balance is empty. it also blocks your access to sms features, and messenger, and wipes your sd card. you can see, i'm just reading from this list, but unfortunately, on this virtual machine i'm using, i can't show you messenger parts
but i can show you it deleting files, and methods to try and remove it. now, this trojan also attempts to employ deep learning, and that it learns from the apps you're using on your phone and it attempts to either avoid detection, or avoid basically being able to be removed by the user, based on what you actually open. before we do anything, this is our shared folder. this actually represents the sd card that will be inserted into your phone. here, i just have some pictures of some ddr scores (dance dance revolution) that i've gotten over the past months. you know, basic nerd stuff. but, nothing too important. now, imagine you had a bunch of apps, or files, or pictures or whatever you might have on your sd card, that you wouldn't want to lose, or you wouldn't want to download this trojan.
so now it's on the phone, and we're gonna go ahead and install it. and right away, it actually wipes our shared folder. all of our pictures are immediately gone. so that's.. bad. and right now if we actually had access to messenger, and any messaging applications, we would be locked out of them and it would be sending random messages to our contacts, to drain our balance. and finally we get the prompt that says: "to ensure the correct installation of elite, you must press the "activate" button below." which gives it administrator privileges. so, we're gonna go ahead and do that. now, i must apologize. i am a complete android noob. i actually use an iphone that i've had since about 2009.
so, you can hate on me all you want for that. but, i'm trying to sort of struggle through this so i can demonstrate what elite actually does. first things first, we have it installed, but now it has disappeared from our apps list. and it does not appear on our recent apps either. so, you know, basic stealth kind of stuff is happening. if we take a look at our apps list, we can see it installed here. however we cannot stop it, uninstall it, move it, do anything with it. take a look at the things its actually doing with our phone or tablet or our what have you. so, it can read the phone status and identity, edit text messages,
read them, send them, send sms messages, read your contacts, modify or delete the contents of your sd card, which you probably see it has done. so basically, as soon as you install this, your device loses all data from the sd card. it'll also retrieve running apps, and run at startup so, we can see that it's viewing what you're trying to run. so now, we're gonna try downloading an antivirus. we're gonna use avg, actually. usually, it can detect it, however you'll see in a moment, something interesting happens, with that sort of deep learning stuff i was talking about.
okay, so we're launching avg, we're gonna get it started, give me the ads, and we're gonna scan. we'll see if avg will actually pick up on this. it's found a couple threats so far almost done with the scan and there we go "simple message receiver may contain potentially unwanted program." and we also have malware detected as elite. so this actually came out last year so, it makes sense that it will now be detected and classified as malware. if we try to uninstall it, you can't because its a device administrator.
but, luckily this prompt allows us to deactivate it, and then uninstall. and then uninstaller is.. ..where did avg go avg okay we're stuck here, that's nice. okay, lets try relaunching avg okay, take 2 alright, we have now successfully uninstalled this malware from our device if we take a look at the apps, it is no longer present, and elite is no longer on the phone
however, the damage has been done your sms messages have been charged to your account, and your sd card contents have been lost. but now, take a look at one more thing that i actually found during a preliminary testing of this trojan. okay, so this part is recorded a bit before the parts i recorded previously. but i wanted to document this because this was pretty interesting to me. so, i was doing some preliminary testing on elite, and so we saw before that avg was able to detect it. and here we do have it still installed, right here, it's running. it would've been sending sms messages, having deleted the contents of the sd card once again
it will run at startup, et cetera. but, this time when we run avg, it doesn't pick it up. so maybe, this is an example of the, sort of, learning behavior? sort of learning how to avoid detection, when, before we've seen that it was already able to detect it. so here, avg says we are protected, even though we already know that elite is fully installed and operating in the background as we speak. of course, maybe that just goes to show that avg is complete garbage so, we are going to try downloading another antivirus. we'll see if that makes any difference.. why not norton? cause everybody knows norton is good.
avast. avast is better. it'll actually do a good run for once. okay, so lets try this scan here for avast. so, avast has actually detected it. so, although it may have evaded avg this time, it did not evade.. an actually good antivirus. so, lets see.. click uninstall here. did it work? did it uninstall it? no.. at least avg let us fix the administration issues. okay! so this is turning out to be a lot of fun.. so, yeah, elite is still installed.
i'm pretty sure. yeah, so. avg didn't find it. and avast found it, but can't delete it. so, thats a lot of fun, isn't it? alright.. lets try norton okay, so our device is at risk did it find this? it found elite. can we delete it? alright, norton lets us manage the device administrators.
surprisingly, norton actually did it. i'm amazed. that should take care of it. okay, we are good to go now. so, avg stopped detecting it for some reason. avast found it but couldn't remove it, and norton actually solved all our issues. that's kind of scary.. but. i think that is about it. i don't have much more to cover about this. there's not much more i can say about elite but,
please be sure to check out my friend, siraj's youtube channel if you're interested in learning how to combat these sorts of threats. and learning sort of advanced programming techniques. if you're interested in any kind of computer science, i recommend you go check it out. so you can follow the annotation on the screen or the link in the description. and, yeah, thats about it. thanks for watching
0 comments:
Post a Comment