Detecting Mobile Malware

name: detecting-mobile-malware description: >- Identify and analyze malicious mobile applications through behavioral analysis, signature scanning, permission anomaly detection, and sandboxed execution. Covers Android and iOS malware families, C2 communication patterns, and threat intelligence integration. domain: cybersecurity subdomain: mobile-security tags: - malware - mobile-malware - android-malware - threat-detection - mobsf - virustotal - yara version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1407", "T1409", "T1417", "T1422"] owasp-mobile: ["M1", "M8"] tools: ["mobsf", "virustotal", "yara", "androguard", "apkid"]

Detecting Mobile Malware

Overview

Mobile malware detection combines static signature matching, behavioral analysis, permission anomaly detection, and network traffic inspection to identify trojans, spyware, adware, ransomware, and banking malware on Android and iOS platforms.

Prerequisites

pip install androguard yara-python
pip install apkid            # APK identifier
# VirusTotal API key for hash lookups
# MobSF instance for automated scanning

Workflow

Step 1: Hash and Signature Checks

# Generate hashes
sha256sum target.apk
md5sum target.apk

# VirusTotal lookup
curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum target.apk | cut -d' ' -f1)" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

# APKiD — identify packers, obfuscators, anti-analysis
apkid target.apk

Step 2: YARA Rule Scanning

# mobile_malware.yar
rule Android_Banker {
    meta:
        description = "Generic Android banking trojan"
        author = "CIPHER"
    strings:
        $overlay = "TYPE_APPLICATION_OVERLAY"
        $accessibility = "AccessibilityService"
        $sms = "android.provider.Telephony.SMS_RECEIVED"
        $keylog = "onAccessibilityEvent"
    condition:
        3 of them
}

rule Android_Spyware {
    meta:
        description = "Android spyware indicators"
    strings:
        $camera = "android.permission.CAMERA"
        $mic = "android.permission.RECORD_AUDIO"
        $location = "android.permission.ACCESS_FINE_LOCATION"
        $sms_read = "android.permission.READ_SMS"
        $contacts = "android.permission.READ_CONTACTS"
        $hidden = "android.intent.category.LAUNCHER"
    condition:
        4 of ($camera, $mic, $location, $sms_read, $contacts) and not $hidden
}

yara mobile_malware.yar target.apk
yara -r mobile_malware.yar ./apps_directory/

Step 3: Permission Anomaly Detection

# Extract permissions with androguard
androguard permissions target.apk

# High-risk permission combos (spyware indicators)
# CAMERA + RECORD_AUDIO + ACCESS_FINE_LOCATION + READ_SMS
# BIND_ACCESSIBILITY_SERVICE + SYSTEM_ALERT_WINDOW
# RECEIVE_SMS + SEND_SMS + READ_SMS (SMS stealer)
# BIND_DEVICE_ADMIN + SYSTEM_ALERT_WINDOW (ransomware)

# Check for permissions not matching app category
grep -c 'uses-permission' apktool_out/AndroidManifest.xml

Step 4: Behavioral Indicators

# Dynamic execution in sandbox
# Check for C2 communication patterns
grep -rn 'HttpURLConnection\|OkHttp\|Retrofit' jadx_out/ | head -20

# Check for data exfiltration
grep -rn 'getDeviceId\|getSubscriberId\|getLine1Number' jadx_out/
grep -rn 'getAccounts\|READ_CONTACTS\|READ_CALL_LOG' jadx_out/

# Check for evasion techniques
grep -rn 'isEmulator\|Build.FINGERPRINT\|ro.hardware' jadx_out/
grep -rn 'Debug.isDebuggerConnected\|TracerPid' jadx_out/

# Check for persistence mechanisms
grep -rn 'BOOT_COMPLETED\|BIND_DEVICE_ADMIN' apktool_out/AndroidManifest.xml
grep -rn 'AlarmManager\|JobScheduler\|WorkManager' jadx_out/

Step 5: Network C2 Detection

# Extract URLs and IPs from binary
strings target.apk | grep -E 'https?://' | sort -u
strings target.apk | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u

# Check domains against threat intel
# Use VirusTotal, OTX, or AbuseIPDB for reputation checks

# DGA detection — look for algorithmic domain generation
grep -rn 'Random\|MessageDigest\|\.toHexString' jadx_out/ | grep -i domain

Detection Opportunities

title: Mobile Malware Detection
id: 70e5639f-ae2e-4e80-b2a3-31e21ad5d77e
status: experimental
description: Detects suspicious activity related to detecting mobile malware techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407
  - attack.t1409
  - attack.t1417
  - attack.t1422
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies

Verification

• APK hash checked against VirusTotal
• YARA rules scanned for known signatures
• Permission analysis completed for anomalies
• Behavioral indicators cataloged
• Network IOCs extracted and reputation-checked
• APKiD packer/obfuscator detection run

References

• OWASP MASTG — Malware Analysis
• VirusTotal API
• APKiD
• MITRE Mobile ATT&CK