3

I am reverse engineering an APK file. From the AndroidManifest.xml file, I found the class name (com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu) corresponding to Main Action as shown below:

<application android:allowBackup="true" android:icon="@mipmap/ic_launcher" android:label="System Message" android:name="com.diaisde.miatsnmd.rgEnPhtA" android:supportsRtl="true" android:theme="@android:style/Theme.Translucent.NoTitleBar">
    <activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/>
    <meta-data android:name="com.google.android.gms.version" android:value="12211000"/>
    <meta-data android:name="android.support.VERSION" android:value="26.1.0"/>
    <meta-data android:name="android.arch.lifecycle.VERSION" android:value="27.0.0-SNAPSHOT"/>
    <activity android:name="com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu">
        <intent-filter>
            <action android:name="android.intent.action.MAIN"/>
            <category android:name="android.intent.category.LAUNCHER"/>
        </intent-filter>
    </activity>

However, when I used dex2jar to convert the APK to a JAR file and decompiled the JAR file, I don't see the above class file.

In the com folder, I can only see the packages, com.diaisde.miatsnmd and com.zeqizplcin.zeqizplcin but I can't find com.dfmlhsd.xecpwdugfsln

How do I find the relevant class files for reversing this APK?

I have uploaded the APK file here: http://www.mediafire.com/file/0c9lrbz8o4lotq7/1.zip/file

Password: infected

Please note that this is a malicious APK file, so please analyze accordingly.

Thanks.

Improve this question
11
  • 1
    are there any native libraries in the APK? btw what is supposed to be "shown below"?
    – Igor Skochinsky ♦
    Sep 18, 2018 at 14:00
  • @IgorSkochinsky: I updated the post now. It was supposed to show the AndroidManifest.xml contents. No, I don't see any ".so" files inside the APK. I think, you mean, the shared library might be loaded by the APK upon initialization and this shared library has the classes defined inside it? I only see, "classes.dex", AndroidManifest.xml, resources.arsc, images and Meta-INF inside the APK.
    – Neon Flash
    Sep 18, 2018 at 15:00
  • Does dex2jar support multidex apks? My guess is no. If the apks has multiple dex files, you'll need to figure out how to run dex2jar on the secondary dex files as well.
    – JesusFreke
    Sep 18, 2018 at 16:47
  • Helping hands: 1. apkdecompilers.com 2. javadecompilers.com/apk 3. stackoverflow.com/q/12732882/8928481
    – Biswapriyo
    Sep 18, 2018 at 19:16
  • @JesusFreke As I mentioned, the APK file in this case consists only one dex file called classes.dex. If required, I can put a screenshot of the folder structure of APK as well.
    – Neon Flash
    Sep 19, 2018 at 9:07

2 Answers 2

Reset to default
2

There are two files have "onCreate" method so I guess one of them are the one you need.

sources\android\support\zeqizplcin\zeqizplcin\WhqDcenJ.java

sources\android\support\zeqizplcin\zeqizplcin\KoBGeJtaH.java

Good luck!

Improve this answer
-3

For anyone looking for ans:

1.check if app is DCLing.

2.What payload is loaded.

Hint:here is asset ,using that, most probably a dex/jar is dropped.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.