# Detecting Mobile Malware > - Skill: `majiayu000/detecting-mobile-malware` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds add majiayu000/detecting-mobile-malware` - Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/detecting-mobile-malware/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: majiayu000 (https://skillmd.com/u/majiayu000) - Updated: 2026-09-09 - Page: https://skillmd.com/skills/majiayu000/detecting-mobile-malware --- --- name: detecting-mobile-malware description: >- Identify and analyze malicious mobile applications through behavioral analysis, signature scanning, permission anomaly detection, and sandboxed execution. Covers Android and iOS malware families, C2 communication patterns, and threat intelligence integration. domain: cybersecurity subdomain: mobile-security tags: - malware - mobile-malware - android-malware - threat-detection - mobsf - virustotal - yara version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1407", "T1409", "T1417", "T1422"] owasp-mobile: ["M1", "M8"] tools: ["mobsf", "virustotal", "yara", "androguard", "apkid"] --- # Detecting Mobile Malware ## Overview Mobile malware detection combines static signature matching, behavioral analysis, permission anomaly detection, and network traffic inspection to identify trojans, spyware, adware, ransomware, and banking malware on Android and iOS platforms. ## Prerequisites ```bash pip install androguard yara-python pip install apkid # APK identifier # VirusTotal API key for hash lookups # MobSF instance for automated scanning ``` ## Workflow ### Step 1: Hash and Signature Checks ```bash # Generate hashes sha256sum target.apk md5sum target.apk # VirusTotal lookup curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum target.apk | cut -d' ' -f1)" \ -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats' # APKiD — identify packers, obfuscators, anti-analysis apkid target.apk ``` ### Step 2: YARA Rule Scanning ```yaml # mobile_malware.yar rule Android_Banker { meta: description = "Generic Android banking trojan" author = "CIPHER" strings: $overlay = "TYPE_APPLICATION_OVERLAY" $accessibility = "AccessibilityService" $sms = "android.provider.Telephony.SMS_RECEIVED" $keylog = "onAccessibilityEvent" condition: 3 of them } rule Android_Spyware { meta: description = "Android spyware indicators" strings: $camera = "android.permission.CAMERA" $mic = "android.permission.RECORD_AUDIO" $location = "android.permission.ACCESS_FINE_LOCATION" $sms_read = "android.permission.READ_SMS" $contacts = "android.permission.READ_CONTACTS" $hidden = "android.intent.category.LAUNCHER" condition: 4 of ($camera, $mic, $location, $sms_read, $contacts) and not $hidden } ``` ```bash yara mobile_malware.yar target.apk yara -r mobile_malware.yar ./apps_directory/ ``` ### Step 3: Permission Anomaly Detection ```bash # Extract permissions with androguard androguard permissions target.apk # High-risk permission combos (spyware indicators) # CAMERA + RECORD_AUDIO + ACCESS_FINE_LOCATION + READ_SMS # BIND_ACCESSIBILITY_SERVICE + SYSTEM_ALERT_WINDOW # RECEIVE_SMS + SEND_SMS + READ_SMS (SMS stealer) # BIND_DEVICE_ADMIN + SYSTEM_ALERT_WINDOW (ransomware) # Check for permissions not matching app category grep -c 'uses-permission' apktool_out/AndroidManifest.xml ``` ### Step 4: Behavioral Indicators ```bash # Dynamic execution in sandbox # Check for C2 communication patterns grep -rn 'HttpURLConnection\|OkHttp\|Retrofit' jadx_out/ | head -20 # Check for data exfiltration grep -rn 'getDeviceId\|getSubscriberId\|getLine1Number' jadx_out/ grep -rn 'getAccounts\|READ_CONTACTS\|READ_CALL_LOG' jadx_out/ # Check for evasion techniques grep -rn 'isEmulator\|Build.FINGERPRINT\|ro.hardware' jadx_out/ grep -rn 'Debug.isDebuggerConnected\|TracerPid' jadx_out/ # Check for persistence mechanisms grep -rn 'BOOT_COMPLETED\|BIND_DEVICE_ADMIN' apktool_out/AndroidManifest.xml grep -rn 'AlarmManager\|JobScheduler\|WorkManager' jadx_out/ ``` ### Step 5: Network C2 Detection ```bash # Extract URLs and IPs from binary strings target.apk | grep -E 'https?://' | sort -u strings target.apk | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u # Check domains against threat intel # Use VirusTotal, OTX, or AbuseIPDB for reputation checks # DGA detection — look for algorithmic domain generation grep -rn 'Random\|MessageDigest\|\.toHexString' jadx_out/ | grep -i domain ``` ## Detection Opportunities | Signal | Source | Description | |--------|--------|-------------| | Known hash | VirusTotal | APK hash matches known malware | | Packer/obfuscator | APKiD | Commercial or custom packing | | Permission anomaly | Manifest | Excessive dangerous permissions | | C2 communication | Network | Beaconing to known bad IPs | | Evasion code | Source | Emulator/debugger detection | ```yaml title: Mobile Malware Detection id: 70e5639f-ae2e-4e80-b2a3-31e21ad5d77e status: experimental description: Detects suspicious activity related to detecting mobile malware techniques in mobile security context logsource: category: application product: android detection: selection: EventType: error condition: selection level: medium tags: - attack.t1407 - attack.t1409 - attack.t1417 - attack.t1422 - attack.initial_access falsepositives: - Mobile device management platform enforcing security policies ``` ## Verification - [ ] APK hash checked against VirusTotal - [ ] YARA rules scanned for known signatures - [ ] Permission analysis completed for anomalies - [ ] Behavioral indicators cataloged - [ ] Network IOCs extracted and reputation-checked - [ ] APKiD packer/obfuscator detection run ## References - [OWASP MASTG — Malware Analysis](https://mas.owasp.org/MASTG/) - [VirusTotal API](https://docs.virustotal.com/reference/overview) - [APKiD](https://github.com/rednaga/APKiD) - [MITRE Mobile ATT&CK](https://attack.mitre.org/matrices/mobile/)