一个短信拦截马的简单分析 - a3uRa

# coding:utf-8
import os
import re
a = []
ips = []
emails = []
emails_fin = []
phones = []
def deleteSameNum(num):
    num.sort()
    last = num[-1]
    for i in range(len(num)-2, -1, -1):
        if last == num[i]:
            del num[i] 
        else:
            last = num[i]
    return num

def bianli(rootdir):
    for root,dirs,files in os.walk(rootdir):
        for file in files:
            b = os.path.join(root,file)
            a.append(b)
        for dir in dirs:
            bianli(dir)

rootdir = 'classes-out/'  # dex文件 dex2smali
bianli(rootdir)
for i in a:
    file = open(i,'r')
    con = file.read()
    con1 = re.findall(r'[0-9a-zA-Z_]{0,19}@[0-9a-zA-Z]{1,13}\.[com,cn,net]{1,3}',con)
    con2 = re.findall(r'1[35678]\d{9}',con)
    con3 = re.findall(r'http
展开收缩
?://(?:[a-zA-Z]|[0-9]|[[email protected]&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+',con)
    ips.append(con3)
    phones.append(con2)
    emails.append(con1)

def zhuan_(ffff):
    ffff_fin = []
    ffff = [x for x in ffff if x]  # remove 空元素
    for i in ffff:
        for i2 in i:
            ffff_fin.append(i2)  # two 2 one
    return ffff_fin

print deleteSameNum(zhuan_(emails))
print deleteSameNum(zhuan_(phones))
print deleteSameNum(zhuan_(ips))

<?xml version="1.0" encoding="UTF-8"?>
<manifest android:versionCode="1" android:versionName="1.0" package="iuxkikw.zkjaksj.jhyvu" xmlns:android="http://schemas.android.com/apk/res/android">
  <uses-permission android:name="android.permission.WRITE_SMS" />
  <uses-permission android:name="android.permission.SEND_SMS" />
  <uses-permission android:name="android.permission.INTERNET" />
  <uses-permission android:name="android.permission.READ_SMS" />
  <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
  <uses-permission android:name="android.permission.RECEIVE_SMS" />
  <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
  <uses-permission android:name="android.permission.INTERNET" />
  <uses-permission android:name="android.permission.READ_PHONE_STATE" />
  <application android:allowBackup="true" android:debuggable="true" android:icon="@drawable/qqq" android:label="@string/app_name" android:theme="@style/AppTheme">
    <activity android:label="@string/app_name" android:name="com.fhgfd.heee.MainActivity">
      <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
      </intent-filter>
    </activity>
    <receiver android:description="@string/app_name" android:label="@string/app_name" android:name="com.fhgfd.heee.kc" android:permission="android.permission.BIND_DEVICE_ADMIN">
      <meta-data android:name="android.app.device_admin" android:resource="@xml/xyz" />
      <intent-filter>
        <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
      </intent-filter>
    </receiver>
    <receiver android:name="com.fhgfd.heee.kd">
      <intent-filter android:priority="2147483647">
        <action android:name="b.b.b" />
        <action android:name="android.provider.Telephony.SMS_RECEIVED" />
        <action android:name="android.intent.action.BOOT_COMPLETED" />
        <action android:name="android.intent.action.USER_PRESENT" />
      </intent-filter>
      <intent-filter>
        <action android:name="android.intent.action.PACKAGE_ADDED" />
        <action android:name="android.intent.action.PACKAGE_REMOVED" />
        <data android:scheme="package" />
      </intent-filter>
    </receiver>
    <service android:name="com.fhgfd.heee.kse" />
  </application>
</manifest>

package com.example.lib.tttest1;

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class tttest1 {
    public static byte[] parseHexStr2Byte(String hexStr) {
        if (hexStr.length() < 1)
            return null;
        byte[] result = new byte[hexStr.length() / 2];
        for (int i = 0; i < hexStr.length() / 2; i++) {
            int high = Integer.parseInt(hexStr.substring(i * 2, i * 2 + 1), 16);
            int low = Integer.parseInt(hexStr.substring(i * 2 + 1, i * 2 + 2), 16);
            result[i] = (byte) (high * 16 + low);
        }
        return result;
    }


    public static String decrypt(String content, String key) {
        try {
            Cipher cipher = Cipher.getInstance("AES");
            cipher.init(2, new SecretKeySpec(tttest1.parseHexStr2Byte(key), "AES"));
            String v3 = new String(cipher.doFinal(tttest1.parseHexStr2Byte(content)));
            return v3;
        }
        catch(Exception e) {
            e.printStackTrace();
        }
        return null;
    }

    public static void main(String[] args) {
        String a = decrypt("37349EC2F427A1AF812DA757988CB9DE", "AE920882F4F5818501AB6256F91691D5");
        System.out.println(a);
    }
}