[General Questions and Answers] rootkitty:
Hi All

I'm hoping somebody with some experience in android explots can give me some advice as to how to proceed.

I'm not 100% sure, but I think my Unrooted Samsung Galaxy SIIX (T989D) running Android 2.3.5 as picked up a rootkit from an application in the marketplace (unless it is in the factory rom).

I turned on logging on my dd-wrt router and left the wifi turned on overnight on the phone to see what traffic it was generating, and to my surprise I found a number of regular transmissions to 61.135.185.18 in China! I did some googing and I got no meaningful hits on either the IP address, or the destination port 5287. (See Samples below)

I thought it may be something from a legitimate app, so I bought a copy of Connection Tracker Pro v1.2.1 and ran some logging with it as well. It does not detect the traffic to 61.135.185.18, but the router logging shows there is traffic to 61.135.185.18. This makes me think I have a root kit.

Any help suggestions would be much appreciated.

Thanks

-------Sample DD-WRT Log Entries - grep'd on 61.135.185.18

<12>Nov 2 19:57:49 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=38231 DF PROTO=TCP SPT=39126 DPT=5287 SEQ=3205847814 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00ACCE5100000000010
<12>Nov 2 20:20:54 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=47365 DF PROTO=TCP SPT=43467 DPT=5287 SEQ=3465957973 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00AEEB5000000000010
<12>Nov 2 20:32:26 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=53575 DF PROTO=TCP SPT=41404 DPT=5287 SEQ=1406085128 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00AFF94F00000000010
<12>Nov 2 20:55:28 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=43876 DF PROTO=TCP SPT=58783 DPT=5287 SEQ=1615511054 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00B2156A00000000010
<12>Nov 2 21:18:31 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=2458 DF PROTO=TCP SPT=55087 DPT=5287 SEQ=1822832878 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00B43174000000000103
<12>Nov 2 21:30:03 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=11771 DF PROTO=TCP SPT=36449 DPT=5287 SEQ=4071690820 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00B53FBF00000000010
<12>Nov 2 22:53:09 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=7021 DF PROTO=TCP SPT=57218 DPT=5287 SEQ=652394530 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00BCDB4F0000000001030
<12>Nov 2 23:39:14 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=62101 DF PROTO=TCP SPT=36066 DPT=5287 SEQ=1067966767 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00C113BA00000000010
<12>Nov 2 23:39:17 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=62102 DF PROTO=TCP SPT=36066 DPT=5287 SEQ=1067966767 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00C114E700000000010
<12>Nov 2 23:39:24 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=62103 DF PROTO=TCP SPT=36066 DPT=5287 SEQ=1067966767 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00C1174000000000010
<12>Nov 2 23:50:55 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=44270 DF PROTO=TCP SPT=48104 DPT=5287 SEQ=3474295228 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00C2255200000000010
<12>Nov 3 00:02:26 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=45078 DF PROTO=TCP SPT=58077 DPT=5287 SEQ=1414366025 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00C3335F00000000010
<12>Nov 3 00:13:58 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.115 DST=61.135.185.18 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=52043 DF PROTO=TCP SPT=51572 DPT=5287 SEQ=3673393876 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A00C4419F00000000010

---

Whois for 61.135.185.18

% Information related to '61.135.185.0 - 61.135.185.255'

inetnum: 61.135.185.0 - 61.135.185.255

netname: SADF

descr: YBV

country: CN

admin-c: WJ1558-AP

tech-c: WJ1558-AP

mnt-by: MAINT-CNCGROUP-BJ

changed: [email protected] 20100806

status: ASSIGNED NON-PORTABLE

source: APNIC

person: wu jiang

address: wu

country: CN

nic-hdl: WJ1558-AP

phone: +86-010-82602212

fax-no: +86-010-67561924

e-mail: [email protected]

mnt-by: MAINT-CNCGROUP-BJ

changed: [email protected] 20100806

source: APNIC

% This query was served by the APNIC Whois Service version 1.68.5 (WHOIS1)