๐๐๐ฒ ๐ ๐ข๐ง๐๐ข๐ง๐ ๐ฌ
Ducex is an advanced Chinese Android packer found in Triada samples, whose primary goal is to complicate analysis and confuse the detection of its payload.
ยท ๐๐ป๐ฐ๐ฟ๐๐ฝ๐๐ฒ๐ฑ ๐๐๐ป๐ฐ๐๐ถ๐ผ๐ป๐: The packer employs serious obfuscation through function encryption using a modified RC4 algorithm with added shuffling.
ยท ๐ซ๐ข๐ฅ๐ฒ๐ฑ ๐ฆ๐๐ฟ๐ถ๐ป๐ด๐: Beyond functions, all strings used by Ducex are also encrypted using a simple sequential XOR algorithm with a changing 16-byte key.
ยท ๐๐ฒ๐ฏ๐๐ด๐ด๐ถ๐ป๐ด ๐๐ต๐ฎ๐น๐น๐ฒ๐ป๐ด๐ฒ๐: Ducex creates major roadblocks for debugging. It performs APK signature verification, failing if the app is re-signed. It also employs self-debugging using fork and ptrace to block external tracing and stops running if tools like Frida are detected in memory.
These capabilities represent a concerning trend toward more resilient malware that can adapt to and evade security measures.
๐๐ฆ๐ฉ๐๐๐ญ ๐จ๐ง ๐๐จ๐ซ๐ฉ๐จ๐ซ๐๐ญ๐ ๐๐ฒ๐๐๐ซ๐ฌ๐๐๐ฎ๐ซ๐ข๐ญ๐ฒ
The findings have significant implications for the cybersecurity community:
ยท ๐๐ฒ๐๐ฒ๐ฐ๐๐ถ๐ผ๐ป ๐๐ต๐ฎ๐น๐น๐ฒ๐ป๐ด๐ฒ๐: Traditional signature-based detection methods are largely ineffective against this level of obfuscation, requiring more sophisticated behavioral analysis techniques.
ยท ๐๐ป๐ฎ๐น๐๐๐ถ๐ ๐๐ผ๐บ๐ฝ๐น๐ฒ๐ ๐ถ๐๐: Security researchers must develop new methodologies to analyze heavily obfuscated malware, potentially requiring specialized tools and extended analysis timeframes.
ยท ๐ ๐ผ๐ฏ๐ถ๐น๐ฒ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐๐ผ๐ป๐ฐ๐ฒ๐ฟ๐ป๐: The integration of such sophisticated protection mechanisms into mobile malware represents an escalation in the mobile threat landscape, particularly for Android devices.
The research contributes to the broader understanding of advanced persistent threats (APTs) and sophisticated malware families. It provides detailed technical documentation, including decryption scripts and indicators of compromise (IOCs) to assist the security community in detecting and analyzing similar threats.
Read the full article in ANY.RUNโs blog.
๐๐๐จ๐ฎ๐ญ ๐๐๐.๐๐๐
ANY.RUN is an interactive malware analysis and threat intelligence provider trusted by SOCs, CERTs, MSSPs, and cybersecurity researchers. The companyโs solutions are leveraged by 15,000 corporate security teams for incident investigations worldwide.
With real-time visibility into malware behavior, a focus on real-time interaction and actionable intelligence, ANY.RUN accelerates incident response, supports in-depth research, and helps defenders stay ahead of evolving threats.
The ANY.RUN team
ANYRUN FZCO
+1 657-366-5050
email us here
Visit us on social media:
LinkedIn
Twitter