detecting-mobile-malware-behavior

name	detecting-mobile-malware-behavior
description	Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
domain	cybersecurity
tags	["mobile-security","android","ios","malware-analysis","owasp-mobile","penetration-testing"]
subdomain	mobile-security
author	oyi77
version	1.0.0
license	Apache-2.0
nist_csf	["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"]

Detecting Mobile Malware Behavior

Overview

Cybersecurity skill for detecting mobile malware behavior. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting mobile malware behavior"
• "Analyzing suspicious mobile applications submitted by users or discovered during"
• "Monitoring enterprise mobile fleet for malicious app indicators"
• "Performing malware triage on APK/IPA samples"

Use this skill when:

• Analyzing suspicious mobile applications submitted by users or discovered during incident response
• Monitoring enterprise mobile fleet for malicious app indicators
• Performing malware triage on APK/IPA samples
• Investigating data exfiltration or unauthorized device access from mobile apps

Do not use this skill to create, enhance, or distribute malware. This skill is for defensive analysis only.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Isolated analysis environment (dedicated device or emulator, not connected to production networks)
• MobSF for automated static+dynamic analysis
• Frida/Objection for runtime behavior monitoring
• Wireshark/tcpdump for network traffic capture
• Android emulator (AVD) or Genymotion for safe execution
• VirusTotal API key for hash lookups

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}