Ruchna Nigam - Android Packers: Separating from the Pack

### Overview Ruchna Nigam, a malware analyst at Fortinet, presents an examination of Android runtime packers and their evolving role in mobile malware analysis. While packers were initially designed for legitimate purposes like code protection, tamper-proofing, and DRM to prevent tampering with published applications, those same defenses become anti-analysis mechanisms when applied to malware. Nigam details the anatomy of Android runtime packers—comparing them to executable Russian nesting dolls that unpack and run nested executables in memory—and evaluates four specific packers: Panxi, LIAPP, Bangcle (referred to phonetically as Benkel), and APKProtect. She demonstrates practical unpacking methodologies, highlighting the challenges packers pose for automated security scanners and detection pipelines.

### Key Topics - **Runtime Packer Concepts**: Comparison of runtime packers to Russian nesting dolls and desktop analogues like UPX in Windows malware, where an outer wrapper decrypts and executes Dalvik executables in memory. - **Packer Analysis (Four Tools)**: - **Panxi**: An analyst-friendly packer analyzed purely statically. It relies on a wrapper application, loads a native library (`nsecure`), checks integrity via an AES-decrypted digest file (`diesd`), and decrypts the target application payload (`clex`) with simple XOR and Base64 before launching it via `DexClassLoader`. - **LIAPP**: A publicly hosted packing service that does not scan submissions for malware. It obfuscates original classes and uses anti-debugging mechanisms. A demonstrated unpacking approach uses an Android emulator, GDB server/client, memory inspection to locate an optimized DEX file via its magic number, and tools like baksmali/smali to extract readable code. A 'level two' variant includes anti-VM checks that crash on emulators. - **Bangcle (Benkel)**: A widely publicized runtime packer. While its cloud service scans and rejects known malware, it remains vulnerable to unknown threats. It employs native library decryption, obfuscated Dalvik-to-JNI mappings, hooked `ptrace`, disabled stack backtracing, and anti-debugging tricks. - **APKProtect**: An armor-style packer that breaks analysis tools like `apktool` and `dex2jar`. It employs complex string obfuscation involving swapped bytes, reflection-based Base64 decoding, XOR operations, and DES encryption. - **Malware Usage & Detection**: Real-world sightings of these packers protecting malicious payloads (including SMS-sending malware) and the difficulties involved in detecting packed threats.

### Technical Details - **Dynamic Unpacking via Memory Dumping**: Nigam demonstrates attaching GDB server to an emulator process. Because the primary application process blocks debugger attachment via anti-debugging routines, she identifies spawned child tasks and attaches to the final task where the payload is completely unpacked in memory. Inspecting `/proc/<pid>/maps` reveals temporary files and memory segments containing the magic bytes for an optimized DEX (`odex`) file. Once dumped from memory, `baksmali` converts the optimized DEX to Smali files, which can then be decompiled into Java source using a Java decompiler. - **Static Analysis & Crypto Reversal**: In Panxi, exports from `nsecure` (`verify_digest` and `decrypt_x`) revealed AES decryption and XOR keys directly in plaintext. Conversely, APKProtect required reversing nested layers: extracting a hardcoded XOR key to generate the Base64 API string, invoking decoding via Java reflection, and applying DES decryption where the key (`safeguard`) was exposed via the Androguard-based sandbox Andrubis.

### Takeaways - Detecting packed malware based purely on visible static signatures (such as static wrapper class names or shared library names) yields unacceptable false-positive rates because legitimate applications share the same packer artifacts. - Dynamic memory dumping remains a highly effective, generic unpacking technique against modern packers, provided analysts can bypass anti-debugging and anti-VM safeguards. - Antivirus and malware analysis pipelines must strike a careful operational balance between resource-intensive dynamic analysis (running samples in sandboxes/emulators to observe behavior or dump memory) and time-consuming manual reverse engineering of emerging packers.