Search for suspicious code patterns in decompiled sources:
# Search for network communication
grep -rn "HttpURLConnection\|OkHttpClient\|Retrofit\|Volley\|URL(" jadx_output/sources/
# Search for SMS operations
grep -rn "SmsManager\|getDefault().sendTextMessage\|SMS_RECEIVED" jadx_output/sources/
# Search for overlay attack code
grep -rn "SYSTEM_ALERT_WINDOW\|TYPE_APPLICATION_OVERLAY\|WindowManager.LayoutParams" jadx_output/sources/
# Search for accessibility service abuse
grep -rn "AccessibilityService\|onAccessibilityEvent\|performAction" jadx_output/sources/
# Search for data exfiltration
grep -rn "getDeviceId\|getSubscriberId\|getSimSerialNumber\|getLine1Number" jadx_output/sources/
# Search for crypto operations (key storage, encryption)
grep -rn "SecretKeySpec\|Cipher.getInstance\|AES\|DES\|RSA" jadx_output/sources/
# Search for dynamic code loading
grep -rn "DexClassLoader\|PathClassLoader\|loadDex\|loadClass" jadx_output/sources/
# Search for obfuscated strings and decryption
grep -rn "Base64.decode\|decrypt\|decipher\|xor" jadx_output/sources/
Step 4: Analyze C2 Communication
Trace the network communication logic:
# Automated C2 extraction from decompiled codeimport os
import re
jadx_dir = "jadx_output/sources"# Patterns for C2 URLs and IPs
url_pattern = re.compile(r'https?://[^\s"\'<>]+')
ip_pattern = re.compile(r'"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"')
base64_pattern = re.compile(r'"([A-Za-z0-9+/]{20,}={0,2})"')
urls = set()
ips = set()
b64_strings = set()
for root, dirs, files in os.walk(jadx_dir):
for fname in files:
if fname.endswith('.java'):
filepath = os.path.join(root, fname)
withopen(filepath, 'r', errors='ignore') as f:
content = f.read()
formatchin url_pattern.finditer(content):
urls.add(match.group())
formatchin ip_pattern.finditer(content):
ips.add(match.group(1))
formatchin base64_pattern.finditer(content):
b64_strings.add(match.group(1))
print("URLs found:")
for u in urls:
print(f" {u}")
print("\nIP addresses:")
for ip in ips:
print(f" {ip}")
# Decode Base64 stringsimport base64
print("\nDecoded Base64 strings:")
for b64 in b64_strings:
try:
decoded = base64.b64decode(b64).decode('utf-8', errors='ignore')
ifany(c.isprintable() for c in decoded) andlen(decoded) > 3:
print(f" {b64[:30]}... -> {decoded[:100]}")
except:
pass
Step 5: Examine Native Libraries
Check for native code that may contain additional malicious logic:
# List native libraries in the APK
unzip -l malware.apk | grep "\.so$"# Extract native libraries
unzip malware.apk "lib/*" -d apk_native/
# Check native library properties
file apk_native/lib/armeabi-v7a/*.so
readelf -d apk_native/lib/armeabi-v7a/*.so | grep NEEDED
# Strings from native libraries
strings apk_native/lib/armeabi-v7a/libpayload.so | grep -iE "(http|url|key|encrypt|password)"# For deep native analysis, import into Ghidra:# File -> Import -> Select .so file -> Select ARM architecture
Step 6: Document Analysis and Extract IOCs
Compile a comprehensive Android malware analysis report:
Analysis documentation should include:
- APK metadata (package name, version, signing certificate)
- Permission analysis with risk assessment
- Component analysis (activities, services, receivers, providers)
- Decompiled code walkthrough of malicious functions
- C2 communication protocol and endpoints
- Data exfiltration methods and targeted data types
- Persistence mechanisms (device admin, accessibility service)
- Evasion techniques (emulator detection, root detection)
- Extracted IOCs (C2 URLs, domains, IPs, signing certificate hash)
Key Concepts
Term
Definition
APK (Android Package)
Android application package format containing compiled DEX bytecode, resources, manifest, and native libraries
DEX Bytecode
Dalvik Executable format containing compiled Java/Kotlin code; JADX converts this back to readable Java source
Overlay Attack
Banking trojan technique displaying a fake UI layer over a legitimate banking app to steal credentials using SYSTEM_ALERT_WINDOW permission
Accessibility Service Abuse
Malware registering as an accessibility service to capture screen content, perform actions, and prevent uninstallation
Smali
Human-readable representation of DEX bytecode; intermediate representation between bytecode and Java used by apktool
Dynamic Code Loading
Loading additional DEX code at runtime using DexClassLoader to hide malicious functionality from static analysis
Device Admin Abuse
Malware requesting device administrator privileges to prevent uninstallation and perform device wipe threats
Tools & Systems
JADX: Open-source DEX to Java decompiler providing GUI and CLI for Android APK analysis with deobfuscation support
apktool: Tool for reverse engineering Android APK files to smali code and decoded resources
androguard: Python framework for automated Android APK analysis including permission, component, and code analysis
Frida: Dynamic instrumentation toolkit for hooking Java methods and native functions at runtime on Android
MobSF (Mobile Security Framework): Automated mobile application security testing framework for static and dynamic analysis
Common Scenarios
Scenario: Analyzing an Android Banking Trojan
Context: A banking trojan APK is distributed via SMS phishing targeting customers of a specific bank. The sample needs analysis to identify targeted banks, C2 infrastructure, and data theft mechanisms.
