ev-flow/quark-engine

Última actividad de origen registrada: 25 de julio de 2026 a las 11:02

Catálogo de SkillsMP actualizado: 29 de octubre de 2026 a las 18:30

skills recopiladas: 5

Estrellas en GitHub: 1736
Forks en GitHub: 220

Instalar con un asistente de IA

Copia este prompt en el asistente de IA que estés usando.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/ev-flow/quark-engine.

README del repositorio

Archivo de origen del README: README.md

Leer el README original

Mostrar README completo

<a href="https://www.blackhat.com/asia-24/arsenal/schedule/index.html#quark-script---dig-vulnerabilities-in-the-blackbox-37549"> <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202024-blue"> </a> <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458"> <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue"> </a> <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/"> <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red"> </a> <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference"> <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue"> </a> <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml"> <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg"> </a> <a href="https://codecov.io/gh/quark-engine/quark-engine"> <img alt="codecov" src="https://codecov.io/gh/ev-flow/quark-engine/graph/badge.svg"> </a> <a href="https://github.com/18z/quark-rules/blob/master/LICENSE"> <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg"> </a> <a href="https://www.python.org/downloads/release/python-31015/"> <img alt="python version" src="https://img.shields.io/badge/python-3.10-blue.svg"> </a> <a href="https://pypi.org/project/quark-engine/"> <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine"> </a> <a href="https://twitter.com/quarkengine"> <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social"> </a> <img src="https://i.imgur.com/8GwkWei.png"/> ## Malware Family Analysis Report Showcase <table> <tr> <td><img src="https://github.com/user-attachments/assets/e8f150e8-a27f-4d0f-b3f0-346714a4cdc4" width="310"></td> <td><img src="https://github.com/user-attachments/assets/1a209c41-7f14-4a71-957a-637148e8a5ec" width="310"></td> <td><img src="https://github.com/user-attachments/assets/ad93ee2d-e65d-4ac6-8df2-909153151f68" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/ea66a178-0eb1-4832-9b3f-745b973639aa" width="310"></td> <td><img src="https://github.com/user-attachments/assets/342a4e3f-33bd-4ff4-92ed-7869356ee1c7" width="310"></td> <td><img src="https://github.com/user-attachments/assets/a95e99b1-b7aa-4672-89be-cd2f6bc9e3cd" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/311fbc66-0e41-47f0-a3e7-7601e074050f" width="310"></td> <td><img src="https://github.com/user-attachments/assets/0b79b59f-7f76-40e1-8891-78714c06cffb" width="310"></td> <td><img src="https://github.com/user-attachments/assets/3b906cc0-d956-4ab2-851d-5da2767926e8" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/1523eeb8-cfca-4c5a-b63d-38887312b673" width="310"></td> <td><img src="https://github.com/user-attachments/assets/60b5afac-3244-480e-9aad-0337183bc6a0" width="310"></td> <td><img src="https://github.com/user-attachments/assets/ea8d1e15-234b-4197-8d3e-1984fcacb6c7" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/b3437fa0-e1a7-465c-8de7-92b25ba99eda" width="310"></td> <td><img src="https://github.com/user-attachments/assets/fb4c16ba-a266-4453-b335-ad470a23e2e5" width="310"></td> <td><img src="https://github.com/user-attachments/assets/dd7cae0f-c27d-41cb-8e56-813aa2ff5997" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/e1c2b16a-819e-4399-8b9e-79899ee2d1b8" width="310"></td> <td><img src="https://github.com/user-attachments/assets/03b5a2e2-7dda-4fb7-8462-d2a83bf38bbb" width="310"></td> <td><img src="https://github.com/user-attachments/assets/aa51bd06-de3e-4bcc-95cd-22ecc8b27c01" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/986d23eb-48de-459f-9714-f4685fd3e696" width="310"></td> <td><img src="https://github.com/user-attachments/assets/d175889c-1442-428d-911a-628b5cdbb7d4" width="310"></td> <td><img src="https://github.com/user-attachments/assets/514f2dd2-d456-42b9-8d15-18e6988e3aa5" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/9eaf2751-1579-4fba-9d71-d201b723dc4d" width="310"></td> <td><img src="https://github.com/user-attachments/assets/dfe535ee-71fa-499b-98eb-0a8f4854182c" width="310"></td> <td><img src="https://github.com/user-attachments/assets/d827122b-63cf-4370-895d-e38a274d19c9" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/f39034b9-4920-421d-9078-d030c3409571" width="310"></td> <td><img src="https://github.com/user-attachments/assets/98db18dc-526c-481f-bf4f-62bea5fde5ee" width="310"></td> <td><img src="https://github.com/user-attachments/assets/aabc5739-074c-4336-9352-c79a6b737067" width="310"></td> </tr> <tr> <td><img src="https://github.com/user-attachments/assets/91d88a98-5387-401c-b8a9-d09b122ba681" width="310"></td> <td><img src="https://github.com/user-attachments/assets/7a608c0d-8e12-4b77-92cd-b785c5572f2c" width="310"></td> <td><img src="https://github.com/user-attachments/assets/276ab27a-3880-4847-8aec-3ed5f77949bc" width="310"></td> </tr> </table> | Family | Summary | Signature Behaviors | Report | |-------------|----------------------------------------------------|--------------------------|--------| | DroidKungFu | Privilege escalation with C2 control. | 1. Gain unlimited access to a device. 2. Install/Uninstall additional apps. 3. Forward confidential data. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#droidkungfu-malware-family-analysis-report) | | GoldDream | SMS/call log exfiltration with remote C2 commands. | 1. Monitor SMS messages and phone calls. 2. Upload SMS messages and phone calls to remote servers. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#golddream-malware-family-analysis-report) | | SpyNote | Credential theft and device surveillance via RAT. | 1. Take screenshots. 2. Simulate user gestures. 3. Log user input. 4. Communicate with C2 servers. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#spynote-malware-family-analysis-report) | | DawDropper | Dropper that installs banking trojans for financial theft. | 1. Download APKs from remote servers. 2. Install additional APKs. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#dawdropper-malware-family-analysis-report) | | SLocker | Android ransomware locking/encrypting devices. | 1. Lock the device with an overlay screen. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#slocker-malware-family-analysis-report) | | PhantomCard | NFC relay–based financial fraud. | 1. Communicate with C2 servers. 2. Read the payment data of NFC cards. 3. Captures PINs of NFC cards through deceptive screens. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#phantomcard-malware-family-analysis-report) | | ToxicPanda | Banking trojan enabling on-device fraud. | 1. Abuse Accessibility. 2. Remote device control. 3. Intercept OTP. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#toxicpanda-malware-family-analysis-report) | | Hydra | Banking trojan using overlay attacks. | 1. Overlay credential theft. 2. Accessibility abuse. 3. Steal OTP/cookies. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#hydra-malware-family-analysis-report) | | SharkBot | Banking trojan targeting financial credentials and transactions. | 1. Abuse Accessibility services. 2. Perform overlay attacks to steal credentials. 3. Intercept SMS messages (OTP). | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#sharkbot-malware-family-analysis-report) | | Antidot | Banking trojan disguised as legitimate updates for financial data theft. | 1. Intercept SMS messages (OTP). 2. Log user input (keylogging). 3. Enable remote control via C2. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#antidot-malware-family-analysis-report) | | Arsink | Banking trojan focusing on credential and financial data exfiltration. | 1. Steal sensitive data from device. 2. Intercept SMS messages (OTP). | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#arsink-malware-family-analysis-report) | | TrickMo | Banking trojan using overlay attacks and accessibility abuse for credential theft. | 1. Overlay attacks to steal banking credentials. 2. Intercept SMS for 2FA bypass. 3. Screen recording and accessibility abuse. 4. Dynamic payload loading via reflection. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#trickmo-malware-family-analysis-report) | | Anubis | Banking trojan with RAT capabilities. | 1. Overlay credential theft. 2. Keylogging. 3. Intercept SMS (OTP). 4. Remote control via C2. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#anubis-malware-family-analysis-report) | | GodFather | Banking trojan targeting financial credentials through overlay and accessibility abuse. | 1. Perform overlay attacks to steal credentials. 2. Abuse Accessibility services. 3. Intercept SMS messages (OTP). 4. Steal banking credentials and sensitive data. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#godfather-malware-family-analysis-report) | | TangleBot | SMS-based Android malware stealing personal and financial data. | 1. Spread through SMS phishing links. 2. Control device interactions and overlay screens. 3. Access SMS, contacts, call logs, camera, and microphone. 4. Steal account and financial information. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#tanglebot-malware-family-analysis-report) | | BRATA | Banking trojan with remote control and anti-analysis capabilities. | 1. Perform overlay attacks to steal banking credentials. 2. Abuse Accessibility services for device control. 3. Intercept SMS messages (OTP). 4. Execute factory reset or device wipe commands. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#brata-malware-family-analysis-report) | | Cerberus | Banking trojan targeting financial credentials through overlay and device control. | 1. Perform overlay attacks to steal credentials. 2. Abuse Accessibility services. 3. Log user input (keylogging). 4. Enable remote control via C2. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#cerberus-malware-family-analysis-report) | | SuperCardX | NFC relay malware enabling contactless payment fraud. | 1. Read NFC payment card data. 2. Relay NFC transactions to attacker-controlled devices. 3. Communicate with C2 servers. 4. Facilitate unauthorized contactless payments. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#supercardx-malware-family-analysis-report) | | NGate | NFC-based malware enabling relay attacks and payment fraud. | 1. Read NFC payment card data. 2. Relay NFC communications to attacker-controlled devices. 3. Communicate with C2 servers. 4. Facilitate unauthorized contactless payments. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#ngate-malware-family-analysis-report) | | AhRat | Android RAT capable of surveillance and data theft. | 1. Record audio from the device. 2. Steal files and sensitive data. 3. Remote access via C2. 4. Execute remote commands. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#ahrat-malware-family-analysis-report) | | AndroRat | Android remote access trojan for device surveillance. | 1. Record audio and capture video. 2. Track device location. 3. Steal files and device information. 4. Execute remote commands. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#androrat-malware-family-analysis-report) | | Sova | Android banking trojan distributed as trojanised carrier apps for credential theft and SMS fraud. | 1. Read device identifiers via the C2 ping-response handler. 2. Inject outbound SMS on operator command. 3. Place phone calls without user consent. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#sova-malware-family-analysis-report) | | EventBot | Banking trojan and infostealer targeting 200+ financial apps. | 1. Enumerate installed applications to pick targets. 2. Intercept incoming SMS via a broadcast receiver. 3. Exfiltrate SMS bodies over HTTP to defeat 2FA. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#eventbot-malware-family-analysis-report) | | Skygofree | Android spyware designed for surveillance and sensitive data collection. | 1. Capture audio. 2. Access stored application data. 3. Download new code at runtime. 4. Capture video. | [View](https://quark-engine.readthedocs.io/en/latest/quark_rules.html#new-quark-rules-for-skygofree) | | Chrysaor | Android build of the Pegasus spyware developed by NSO Group. | 1. Capture audio. 2. Check Internet connectivity. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#chrysaor-malware-family-analysis-report) | | Dendroid | Commercial Android RAT sold on underground forums. | 1. Capture audio. 2. Access data from the local system. 3. Gather SMS messages. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#dendroid-malware-family-analysis-report) | | RuMMS | Android SMS-stealing family spread through SMS phishing links. | 1. Discover network configuration. 2. Gather SMS messages. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#rumms-malware-family-analysis-report) | | Exodus | Android surveillanceware delivered through decoy mobile-operator service apps. | 1. Discover installed applications. 2. Discover network configuration. 3. Gather call log data. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#exodus-malware-family-analysis-report) | | BrainTest | Android malware found in a Google Play game that runs root exploits and pulls further code from its server. | 1. Download new code at runtime. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#braintest-malware-family-analysis-report) | | Herodotus | Android banking trojan built for device takeover, sold as malware-as-a-service. | 1. Access data from the local system. | [View](https://quark-engine.readthedocs.io/en/latest/malware_report.html#herodotus-malware-family-analysis-report) | ## Quick Start ### Step 1. Install via PyPi Install the latest version of Quark Engine: ```bash $ pip3 install -U quark-engine ``` ### Step 2. Download Latest Rules Fetch the latest rule database: ```bash $ freshquark ``` ### Step 3. Run Summary Report Analyze an APK with the downloaded rules and generate a summary report: ```bash $ quark -a <apk_file> -s ``` ### Step 4. View Results Example output: <img width="1280" height="461" alt="Screenshot-2025-11-25-22-36-54" src="https://github.com/user-attachments/assets/fc919b8d-d10d-4f14-bdd5-0a58b0893708" /> ## Quark-Engine Skills Quark-Engine also ships two Claude Code skills: - **`/quark:analysis`** — analyze an APK with Quark-Engine - **`/quark:rule-gen`** — generate a Quark rule from decompiled code To install, run these commands inside Claude Code after installing Quark-Engine: ``` /plugin marketplace add ev-flow/quark-engine /plugin install quark@quark-engine ``` The skills then should appear. ## Acknowledgments ### The Honeynet Project <a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a> ### Google Summer Of Code Quark-Engine has been participating in the GSoC under the Honeynet Project! * 2021: * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://github.com/ev-flow/ref/blob/main/GSoC-2021-YuShiangDang.md) * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://github.com/ev-flow/ref/blob/main/GSoC-2021-ShengFengLu.md) Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. ## Core Values of Quark Engine Team * We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**.

Cargando el README del repositorio…

Skills en este repositorio

Analistas de garantía de calidad de software y probadores Desarrolladores de software

2 categorías ocupacionales · 100% clasificado

skill

ocupación

descripción

actualizado

analysis

Desarrolladores de software

Run Quark Engine analysis on an APK file — produces summary, detail, JSON, web, call graph, behavior map, and classification reports.