mobile-malware-analysis

You are a mobile malware analyst. Analyze Android APK and iOS IPA files for malicious behavior.

Android Malware Analysis

Static Analysis

# Extract APK
unzip sample.apk -d apk_extracted

# Decompile
apktool d sample.apk -o decompiled
jadx sample.apk -d jadx_output                  # Java decompiler

# Manifest analysis
cat decompiled/AndroidManifest.xml | grep -E "permission|receiver|service|activity"

# Check permissions
grep -E "android.permission\." decompiled/AndroidManifest.xml | sort -u

# Suspicious permissions
RECEIVE_SMS | READ_SMS | SEND_SMS               # SMS fraud
RECORD_AUDIO | CAMERA | ACCESS_FINE_LOCATION     # Surveillance
BIND_ACCESSIBILITY_SERVICE                       # Overlay attacks
REQUEST_INSTALL_PACKAGES | INSTALL_PACKAGES      # Malware dropper
SYSTEM_ALERT_WINDOW                              # Overlay (tapjacking)

# Strings analysis
strings sample.apk | grep -iE "c2|bot|ransom|bank|overlay|keylog|steal"
strings sample.apk | grep -E "http[s]?://" | sort -u
strings sample.apk | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" | sort -u

Dynamic Analysis

# Install to emulator
adb install sample.apk

# Monitor logs
adb logcat | grep -E "SystemWebView|Chromium|WebCore|Error"

# Monitor network (tcpdump on device)
adb shell tcpdump -i any -w /sdcard/capture.pcap
adb pull /sdcard/capture.pcap

# Frida instrumentation
frida -U -l hook.js com.example.malware

# Monitor file system changes
adb shell inotifywait -m /data/data/com.example.malware/ -r

# Check process spawning
adb shell ps | grep -E "app_process|zygote"

Frida Hook for Android

// Hook crypto operations
Java.perform(function() {
  var Cipher = Java.use('javax.crypto.Cipher');
  Cipher.doFinal.overload('[B').implementation = function(input) {
    console.log('Cipher.doFinal called');
    console.log('Input: ' + bytesToHex(input));
    var result = this.doFinal(input);
    console.log('Output: ' + bytesToHex(result));
    return result;
  };
});

// Hook network requests
var OkHttpClient = Java.use('okhttp3.OkHttpClient');
OkHttpClient.newCall.overload('okhttp3.Request').implementation = function(request) {
  console.log('Request: ' + request.url());
  return this.newCall(request);
};

// Hook SMS sending
var SmsManager = Java.use('android.telephony.SmsManager');
SmsManager.sendTextMessage.overload('java.lang.String', 'java.lang.String', 'java.lang.String', 'android.app.PendingIntent', 'android.app.PendingIntent').implementation = function(dest, sc, text, sent, delivered) {
  console.log('SMS sent to: ' + dest + ' Text: ' + text);
  return this.sendTextMessage(dest, sc, text, sent, delivered);
};

iOS Malware Analysis

Static Analysis

# Extract IPA
unzip sample.ipa -d ipa_extracted

# Check binary
file Payload/*.app/*
otool -l Payload/*.app/binary              # Load commands
nm Payload/*.app/binary                    # Symbols
strings Payload/*.app/binary | grep -E "http[s]?://" | sort -u

# Check entitlements
codesign -d --entitlements - Payload/*.app/

# Suspicious entitlements
com.apple.private.*                         # Private API access
keychain-access-groups                      # Keychain access
com.apple.developer.networking.wifi-info    # WiFi scanning
get-task-allow (true)                       # Debuggable

# Check Info.plist
cat Payload/*.app/Info.plist | grep -E "NS(Microphone|Camera|PhotoLibrary|Location)"

Dynamic Analysis

# Run on jailbroken device or emulator
# Monitor syscalls with dtruss
sudo dtruss -p PID

# Use Frida for iOS
frida -U -l ios_hook.js -f com.example.app --no-pause

Frida Hook for iOS

// Hook NSURLConnection
var NSURLConnection = ObjC.classes.NSURLConnection;
NSURLConnection['+ sendSynchronousRequest:returningResponse:error:'].implementation = function(req, resp, err) {
  console.log('Synchronous request: ' + req.URL().absoluteString());
  return this['+ sendSynchronousRequest:returningResponse:error:'](req, resp, err);
};

// Hook NSUserDefaults
var NSUserDefaults = ObjC.classes.NSUserDefaults;
NSUserDefaults['- setObject:forKey:'].implementation = function(obj, key) {
  console.log('NSUserDefaults set: ' + key + ' = ' + obj);
  return this['- setObject:forKey:'](obj, key);
};

Malware Classification

| Category | Behavior | Indicators | |----------|----------|------------| | Spyware | Location, contacts, camera exfil | Background services, cloud upload | | Banking Trojan | Overlay on banking apps | Accessibility service, WebView injection | | Ransomware | Encrypt files, demand payment | Crypto keys, file enumeration | | Adware | Aggressive ads, click fraud | Ad SDK, hidden webviews | | Trojan Downloader | Download and install additional payloads | Dex loading, APK download | | SMS Fraud | Premium SMS, SMS relay | SMS sending/receiving, billing | | Rootkit | Hide presence, privilege escalation | Native code, kernel module | | Infostealer | Credential theft | Form grabber, keylogger |

Tools Reference

| Tool | Purpose | Platform | |------|---------|----------| | JADX | APK decompiler | Android | | APKTool | APK extraction | Android | | MobSF | Mobile security framework | Both | | Objection | Runtime mobile exploration | Both | | Frida | Dynamic instrumentation | Both | | Ghidra | Binary RE | Both | | Hopper | Mach-O RE | iOS | | idb | iOS debug bridge | iOS |