Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
A suspicious Android APK has been reported as malicious or flagged by mobile threat detection
Analyzing Android banking trojans, spyware, SMS stealers, or adware samples
Determining what data an app collects, where it sends it, and what permissions it abuses
Extracting C2 server addresses, encryption keys, and configuration data from Android malware
Understanding overlay attack mechanisms used by banking trojans
Do not use for analyzing obfuscated native (.so) libraries within APKs; use Ghidra or IDA for native ARM binary analysis.
Detection Gaps & Validation
The real payload is often not in the DEX you decompiled. Banking trojans ship a near-empty loader and pull the malicious DEX/APK after install via DexClassLoader/PathClassLoader from assets/, internal storage, or a C2 download. If JADX shows trivial functionality, hunt for runtime-loaded code and decrypt the assets/ blobs — don't conclude benign from the static dex alone.
Obfuscation defeats naive grep. With names mangled to a.a.a, searching for sendTextMessage or AccessibilityService misses everything. Run JADX with --deobf, and trace behavior through the manifest's registered components (services/receivers) and the accessibility/overlay config rather than method names.
String decryption hides C2. C2 URLs are commonly Base64-then-XOR/AES decoded at runtime or held in native .so. Decode the blobs (or hook the decrypt method with Frida) — a clean URL grep is a false negative.
Native logic is invisible to JADX. The actual C2, anti-emulator checks, and crypto frequently live in lib/*/*.so. Load the .so in Ghidra (ARM/ARM64); skipping it is the most common gap.
Confirm dynamically: detonate in an emulator/MobSF with a network capture and Frida hooks to validate the decompiled C2 and exfil paths; static-only analysis misses emulator/root-detection branches and post-install behavior.
Benign-lookalike FPs: legitimate apps also request SMS/accessibility/overlay and load DEX dynamically (packers like Jiagu/Bangcle). Confirm intent via the actual call-out destination and decrypted config, not permissions alone.
Search for suspicious code patterns in decompiled sources:
# Search for network communication
grep -rn "HttpURLConnection\|OkHttpClient\|Retrofit\|Volley\|URL(" jadx_output/sources/
# Search for SMS operations
grep -rn "SmsManager\|getDefault().sendTextMessage\|SMS_RECEIVED" jadx_output/sources/
# Search for overlay attack code
grep -rn "SYSTEM_ALERT_WINDOW\|TYPE_APPLICATION_OVERLAY\|WindowManager.LayoutParams" jadx_output/sources/
# Search for accessibility service abuse
grep -rn "AccessibilityService\|onAccessibilityEvent\|performAction" jadx_output/sources/
# Search for data exfiltration
grep -rn "getDeviceId\|getSubscriberId\|getSimSerialNumber\|getLine1Number" jadx_output/sources/
# Search for crypto operations (key storage, encryption)
grep -rn "SecretKeySpec\|Cipher.getInstance\|AES\|DES\|RSA" jadx_output/sources/
# Search for dynamic code loading
grep -rn "DexClassLoader\|PathClassLoader\|loadDex\|loadClass" jadx_output/sources/
# Search for obfuscated strings and decryption
grep -rn "Base64.decode\|decrypt\|decipher\|xor" jadx_output/sources/
Step 4: Analyze C2 Communication
Trace the network communication logic:
# Automated C2 extraction from decompiled codeimport os
import re
jadx_dir = "jadx_output/sources"# Patterns for C2 URLs and IPs
url_pattern = re.compile(r'https?://[^\s"\'<>]+')
ip_pattern = re.compile(r'"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"')
base64_pattern = re.compile(r'"([A-Za-z0-9+/]{20,}={0,2})"')
urls = set()
ips = set()
b64_strings = set()
for root, dirs, files in os.walk(jadx_dir):
for fname in files:
if fname.endswith('.java'):
filepath = os.path.join(root, fname)
withopen(filepath, 'r', errors='ignore') as f:
content = f.read()
formatchin url_pattern.finditer(content):
urls.add(match.group())
formatchin ip_pattern.finditer(content):
ips.add(match.group(1))
formatchin base64_pattern.finditer(content):
b64_strings.add(match.group(1))
print("URLs found:")
for u in urls:
print(f" {u}")
print("\nIP addresses:")
for ip in ips:
print(f" {ip}")
# Decode Base64 stringsimport base64
print("\nDecoded Base64 strings:")
for b64 in b64_strings:
try:
decoded = base64.b64decode(b64).decode('utf-8', errors='ignore')
ifany(c.isprintable() for c in decoded) andlen(decoded) > 3:
print(f" {b64[:30]}... -> {decoded[:100]}")
except:
pass
Step 5: Examine Native Libraries
Check for native code that may contain additional malicious logic:
# List native libraries in the APK
unzip -l malware.apk | grep "\.so$"# Extract native libraries
unzip malware.apk "lib/*" -d apk_native/
# Check native library properties
file apk_native/lib/armeabi-v7a/*.so
readelf -d apk_native/lib/armeabi-v7a/*.so | grep NEEDED
# Strings from native libraries
strings apk_native/lib/armeabi-v7a/libpayload.so | grep -iE "(http|url|key|encrypt|password)"# For deep native analysis, import into Ghidra:# File -> Import -> Select .so file -> Select ARM architecture
Step 6: Document Analysis and Extract IOCs
Compile a comprehensive Android malware analysis report:
Analysis documentation should include:
- APK metadata (package name, version, signing certificate)
- Permission analysis with risk assessment
- Component analysis (activities, services, receivers, providers)
- Decompiled code walkthrough of malicious functions
- C2 communication protocol and endpoints
- Data exfiltration methods and targeted data types
- Persistence mechanisms (device admin, accessibility service)
- Evasion techniques (emulator detection, root detection)
- Extracted IOCs (C2 URLs, domains, IPs, signing certificate hash)
Key Concepts
Term
Definition
APK (Android Package)
Android application package format containing compiled DEX bytecode, resources, manifest, and native libraries
DEX Bytecode
Dalvik Executable format containing compiled Java/Kotlin code; JADX converts this back to readable Java source
Overlay Attack
Banking trojan technique displaying a fake UI layer over a legitimate banking app to steal credentials using SYSTEM_ALERT_WINDOW permission
Accessibility Service Abuse
Malware registering as an accessibility service to capture screen content, perform actions, and prevent uninstallation
Smali
Human-readable representation of DEX bytecode; intermediate representation between bytecode and Java used by apktool
Dynamic Code Loading
Loading additional DEX code at runtime using DexClassLoader to hide malicious functionality from static analysis
Device Admin Abuse
Malware requesting device administrator privileges to prevent uninstallation and perform device wipe threats
Tools & Systems
JADX: Open-source DEX to Java decompiler providing GUI and CLI for Android APK analysis with deobfuscation support
apktool: Tool for reverse engineering Android APK files to smali code and decoded resources
androguard: Python framework for automated Android APK analysis including permission, component, and code analysis
Frida: Dynamic instrumentation toolkit for hooking Java methods and native functions at runtime on Android
MobSF (Mobile Security Framework): Automated mobile application security testing framework for static and dynamic analysis
Common Scenarios
Scenario: Analyzing an Android Banking Trojan
Context: A banking trojan APK is distributed via SMS phishing targeting customers of a specific bank. The sample needs analysis to identify targeted banks, C2 infrastructure, and data theft mechanisms.
