mobile-malware-analysis

name	Mobile Malware Analysis
description	Mobile malware analysis — Android/iOS malware reverse engineering, behavior analysis
tags	["malware","mobile","android","ios","analysis","reverse-engineering"]

Task: Mobile Malware Analysis. Reverse engineer and analyze malicious mobile applications.

Phase 1: Malware Identification

Suspicious Indicators

Android malware indicators:
1. Excessive permissions (READ_SMS, SEND_SMS, READ_CONTACTS)
2. Suspicious imports (telephony SMS, location)
3. Hardcoded URLs/IPs
4. Base64 encoded strings
5. Native libraries (payloads)
6. Dynamic code loading
7. Reflection usage
8. Obfuscated code
9. Similar to known malware
10. Fake certificate

iOS malware indicators:
1. Entitlements abuse
2. Private APIs usage
3. Hidden code execution
4. Obfuscated strings
5. Suspicious URLs
6. Native code payloads
7. Dynamic loading
8. Encryption without key
9. Code signature issues
10. Repackaged apps

Automated detection:
#!/bin/bash
# Malware scanner

check_permissions() {
    local apk=$1
    aapt dump permissions $apk | grep -E "SEND_SMS|READ_SMS|READ_CONTACTS|ACCESS_FINE_LOCATION"
}

check_urls() {
    local apk=$1
    unzip -p $apk classes.dex | strings | grep -E "https?://|ftp://"
}

check_native() {
    local apk=$1
    unzip -l $apk | grep "\.so$"
}

# Usage
check_permissions app.apk
check_urls app.apk
check_native app.apk

Phase 2: Static Analysis

Android Malware Static Analysis

APK decompilation:
1. Extract APK: unzip app.apk
2. Decode resources: apktool d app.apk
3. Decompile DEX: jadx app.apk
4. Analyze manifest: AndroidManifest.xml

Malware analysis:
- Entry points: main activity, broadcast receivers
- Permissions: dangerous permissions
- Services: background services
- Native code: .so libraries
- Strings: URLs, commands, base64
- Code: suspicious methods

Key findings:
- C2 servers (hardcoded URLs)
- Botnet commands
- Data exfiltration
- Premium rate fraud
- Banking trojans
- Ransomware
- Spyware

iOS Malware Static Analysis

IPA analysis:
1. Decrypt: clutch -f com.victim.app
2. Extract: unzip app.ipa
3. Class dump: class-dump MyApp
4. Analyze binary: Hopper/Ghidra

Malware analysis:
- Objective-C methods
- Swift code
- Native frameworks
- String encryption
- C2 communication
- Data theft
- Keylogging
- Spyware

Key findings:
- Keychain theft
- Pasteboard monitoring
- Background surveillance
- Data exfiltration
- C2 servers
- Spyware
- Stalkerware

Phase 3: Dynamic Analysis

Android Dynamic Analysis

Sandbox analysis:
1. Install APK on emulator
2. Monitor behavior:
   - Network traffic (Burp Suite)
   - File system access
   - SMS/Calls
   - Contacts access
   - Location data
   - Installed apps
   - Running processes
3. Frida instrumentation
4. Logcat monitoring

Tools:
- MobSF: Automated analysis
- Frida: Runtime instrumentation
- Burp Suite: Traffic analysis
- DroidBox: Dynamic analysis
- Android Debug Bridge (ADB)

Analysis script:
#!/bin/bash
# Dynamic analysis

# Install app
adb install malware.apk

# Monitor network
adb logcat | grep -i "http" &

# Monitor file system
adb shell "while true; do find /data/data/com.malware -type f -newer /tmp/start; sleep 5; done" &

# Trigger app
adb shell am start -n com.malware/.MainActivity

# Collect logs
adb logcat -d > malware.log

# Pull files
adb pull /data/data/com.malware/ ./extracted/

iOS Dynamic Analysis

Sandbox analysis:
1. Install IPA on jailbroken device
2. Monitor behavior:
   - Network traffic
   - File system access
   - Keychain access
   - Pasteboard access
   - Background processes
   - Location data
3. Frida instrumentation
4. Syslog monitoring

Tools:
- Frida: Runtime instrumentation
- ssh: Device access
- tcpdump: Traffic capture
- keychain_dumper: Keychain access
- pasteboarddumper: Pasteboard monitoring

Analysis script:
#!/bin/bash
# Dynamic analysis

# Install app
ssh root@device "installipa malware.ipa"

# Monitor network
ssh root@device "tcpdump -i en0 -w /tmp/network.pcap" &

# Monitor filesystem
ssh root@device "while true; do find /var/mobile/Containers/Data/Application/ -type f -newer /tmp/start; sleep 5; done" &

# Monitor logs
ssh root@device "tail -f /var/log/syslog" &

# Trigger app
ssh root@device "uiopen com.malware://"

# Collect data
scp root@device:/tmp/network.pcap .
ssh root@device "tar -czf /tmp/appdata.tar.gz /var/mobile/Containers/Data/Application/{UUID}/"
scp root@device:/tmp/appdata.tar.gz .

Phase 4: Network Analysis

C2 Server Analysis

Identify C2 infrastructure:
1. Extract URLs/IPs from app
2. DNS analysis
3. Whois lookup
4. Geolocation
5. SSL certificate analysis
6. Traffic pattern analysis

C2 communication:
- Protocol (HTTP, HTTPS, custom)
- Frequency (polling interval)
- Data exfiltration
- Command reception
- Heartbeat mechanism

Analysis:
#!/usr/bin/env python3
import requests
import socket

def analyze_c2(url):
    # Check URL
    try:
        response = requests.get(url, timeout=5)
        print(f"[+] Server reachable: {url}")
        print(f"[+] Status: {response.status_code}")
        print(f"[+] Headers: {response.headers}")
    except:
        print(f"[-] Server unreachable: {url}")
    
    # DNS lookup
    domain = url.split('/')[2]
    try:
        ip = socket.gethostbyname(domain)
        print(f"[+] IP: {ip}")
    except:
        pass
    
    # Whois
    # whois domain
    
    # SSL cert
    # openssl s_client -connect domain:443

# Usage
analyze_c2("https://c2.victim.com/api")

Traffic Decryption

Intercept and decrypt traffic:
1. Setup proxy (Burp Suite)
2. Install CA certificate
3. Bypass SSL pinning
4. Capture traffic
5. Analyze decrypted traffic

Analysis:
- Authentication tokens
- Exfiltrated data
- C2 commands
- Bot IDs
- Campaign IDs
- Version checks

Decryption script:
#!/usr/bin/env python3
import scapy.all as scapy

def analyze_pcap(pcap_file):
    packets = scapy.rdpcap(pcap_file)
    
    for packet in packets:
        if packet.haslayer(scapy.Raw):
            payload = packet[scapy.Raw].load
            print(f"[+] {packet.summary()}")
            print(f"[+] Payload: {payload[:100]}")
            
            # Check for encryption
            if is_encrypted(payload):
                print("[-] Encrypted payload")
            else:
                print("[+] Plaintext payload")

# Usage
analyze_pcap("malware_traffic.pcap")

Phase 5: Behavior Analysis

Malware Behavior Classification

Android malware types:
1. Banking trojans
   - Overlay attacks
   - Screen reading
   - SMS interception
   - Credential theft

2. Ransomware
   - File encryption
   - Payment demand
   - File deletion threat

3. Spyware
   - Call recording
   - SMS reading
   - Location tracking
   - Contact harvesting

4. Botnets
   - DDoS attacks
   - Spam sending
   - Click fraud
   - C2 communication

5. Premium rate fraud
   - SMS sending
   - Call making
   - Subscription signup

iOS malware types:
1. Spyware
   - Keylogging
   - Screen capture
   - Location tracking
   - Data theft

2. Banking trojans
   - Overlay attacks
   - Credential theft
   - 2FA interception

3. Ransomware
   - File encryption
   - Device locking
   - Payment demand

4. Stalkerware
   - Location tracking
   - Communication monitoring
   - Data exfiltration

Analysis:
# Behavior analysis
def classify_behavior(permissions, code):
    if "SEND_SMS" in permissions and "READ_SMS" in permissions:
        return "Premium rate fraud or Banking trojan"
    
    if "READ_CONTACTS" in permissions and "ACCESS_FINE_LOCATION" in permissions:
        return "Spyware or Stalkerware"
    
    if "INTERNET" in permissions and has_network_code(code):
        return "Botnet or Data exfiltration"
    
    if has_file_encryption(code):
        return "Ransomware"

Phase 6: Data Extraction

Android Data Extraction

Extract malware data:
1. Databases
2. SharedPreferences
3. Files
4. Native data
5. Encrypted data

Extraction script:
#!/bin/bash
# Extract malware data

# Extract databases
adb shell "run-as com.malware cat /data/data/com.malware/databases/*.db > /sdcard/db.db"
adb pull /sdcard/db.db .

# Extract preferences
adb shell "run-as com.malware cat /data/data/com.malware/shared_prefs/*.xml > /sdcard/prefs.xml"
adb pull /sdcard/prefs.xml .

# Extract files
adb pull /data/data/com.malware/files/ .

# Extract encrypted data
adb pull /data/data/com.malware/app_data/ .

# Analyze
sqlite3 db.db ".dump"
cat prefs.xml

iOS Data Extraction

Extract malware data:
1. Keychain
2. UserDefaults
3. Files
4. Caches
5. Encrypted data

Extraction script:
#!/bin/bash
# Extract malware data

# Extract keychain
ssh root@device "keychain_dumper > /tmp/keychain.txt"
scp root@device:/tmp/keychain.txt .

# Extract preferences
ssh root@device "plutil -p /var/mobile/Containers/Data/Application/{UUID}/Library/Preferences/*.plist" > prefs.txt

# Extract files
scp -r root@device:/var/mobile/Containers/Data/Application/{UUID}/Documents/ ./documents/

# Extract cache
scp -r root@device:/var/mobile/Containers/Data/Application/{UUID}/Library/Caches/ ./cache/

# Analyze
cat keychain.txt
cat prefs.txt

Phase 7: Deobfuscation

String Decryption

Identify encrypted strings:
1. Find decryption routine
2. Extract encrypted data
3. Reverse encryption
4. Decrypt strings

Frida script:
Java.perform(function() {
    var Crypto = Java.use("com.malware.Crypto");
    
    Crypto.decrypt.implementation = function(encrypted) {
        var result = this.decrypt(encrypted);
        console.log("[DECRYPTED] " + result);
        return result;
    };
    
    // Call all decrypt methods
    Java.choose("com.malware.Config", {
        onMatch: function(instance) {
            console.log("[CONFIG] " + instance.toString());
        },
        onComplete: function() {}
    });
});

Code Deobfuscation

Deobfuscate code:
1. Identify obfuscation type
2. Remove obfuscation
3. Rename classes/methods
4. Analyze logic

Tools:
- JEB Decompiler: Auto deobfuscation
- GDA Decompiler: Pattern matching
- JADX: Rename and analyze
- Manual deobfuscation

Process:
1. Decompile with JADX
2. Analyze code patterns
3. Rename classes
4. Understand logic
5. Document findings

Phase 8: IOC Extraction

Indicators of Compromise

Extract IOCs:
1. Domains/URLs
2. IP addresses
3. File hashes
4. Certificate hashes
5. Email addresses
6. Bot IDs
7. Campaign IDs
8. Sample filenames

Extraction script:
#!/usr/bin/env python3
import re
import hashlib

def extract_iocs(apk_path):
    # Extract URLs
    with open(apk_path, 'rb') as f:
        data = f.read()
        urls = re.findall(b'https?://[a-zA-Z0-9.-]+', data)
    
    # Calculate hashes
    md5 = hashlib.md5(data).hexdigest()
    sha1 = hashlib.sha1(data).hexdigest()
    sha256 = hashlib.sha256(data).hexdigest()
    
    iocs = {
        'urls': [u.decode() for u in urls],
        'hashes': {
            'md5': md5,
            'sha1': sha1,
            'sha256': sha256
        }
    }
    
    return iocs

# Usage
iocs = extract_iocs("malware.apk")
print(iocs)

Final Report

[MOBILE MALWARE] Android Banking Trojan
Family: BankBot
Severity: CRITICAL (banking trojan)
Hash: abc123def456...

[Static Analysis]
Package: com.malware.bankbot
Permissions: 45 (including SEND_SMS, READ_SMS)
Entry points: 3 activities, 2 services
Native code: libpayload.so (encryption)
C2 servers: 
  - https://c1.victim.com/api
  - https://c2.victim.com/data
Similar to: BankBot v3.2

[Dynamic Analysis]
Network:
  - C2 communication every 5 minutes
  - Exfiltrates SMS
  - Receives commands
  - Downloads configuration

File system:
  - Creates /data/data/com.malware/databases/accounts.db
  - Stores stolen credentials
  - Encrypts with AES-256

Behavior:
  - Monitors SMS (2FA codes)
  - Steals banking credentials
  - Performs unauthorized transactions
  - Sends SMS to premium numbers

[IOC Extraction]
Domains:
  - c1.victim.com
  - c2.victim.com

IPs:
  - 192.168.1.100
  - 10.0.0.50

Hashes:
  - MD5: abc123...
  - SHA1: def456...
  - SHA256: 789abc...

[Remediation]
1. Uninstall app
2. Change passwords
3. Contact bank
4. Scan device
5. Install security software

Tools

Android:

• MobSF: Automated analysis
• JADX: Decompilation
• apktool: Resource decoding
• Frida: Dynamic analysis
• Burp Suite: Traffic analysis
• DroidBox: Sandbox

iOS:

• Clutch: Decryption
• class-dump: Class dumping
• Hopper/Ghidra: Disassembly
• Frida: Dynamic analysis
• Keychain dumper: Keychain access
• tcpdump: Traffic capture

Analysis:

• VirusTotal: Hash checking
• Hybrid Analysis: Sandbox
• Joe Sandbox: Dynamic analysis
• Cuckoo Sandbox: Behavior analysis

Target platforms: Android (all versions), iOS (all versions)