Malware analysis for an Android APK

Performing malware analysis for an Android APK involves a systematic approach to understand the malicious behavior of the app. This process can be divided into static analysis and dynamic analysis. Here’s a detailed guide on how to perform malware analysis for an Android APK:

1. Prepare Your Environment

Ensure you have the necessary tools installed:

• Android Studio: For decompiling and analyzing APKs.
• Apktool: For decompiling APKs to smali code and resources.
• JD-GUI or JADX: For decompiling DEX files to Java source code.
• dex2jar: For converting DEX files to JAR files.
• ADB (Android Debug Bridge): For interacting with the Android device or emulator.
• ProGuard: For obfuscating and deobfuscating code (optional).
• Frida: For dynamic instrumentation and hooking (optional).

2. Static Analysis

Static analysis involves examining the APK without executing it. This step helps identify potential malicious behavior by analyzing the code, permissions, and resources.

a. Extract and Analyze the Manifest File

The AndroidManifest.xml file provides crucial information about the app’s permissions, components, and intent filters.

sh

apktool d malicious_apk.apk -o output_directory

Examine the manifest for suspicious permissions and components:

xml

<uses-permission android:name="android.permission.READ_SMS"/>
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>

b. Decompile the APK

Use Apktool to decompile the APK to smali code and resources.

sh

apktool d malicious_apk.apk -o output_directory

c. Convert DEX to JAR

Use dex2jar to convert the DEX files to JAR files.

sh

d2j-dex2jar.sh malicious_apk.apk

d. Decompile JAR to Java Source Code

Use JD-GUI or JADX to decompile the JAR file to Java source code.

sh

jadx-gui classes-dex2jar.jar

e. Analyze Smali and Java Code

Look for suspicious patterns, such as:

• SMS Stealing: Code that reads SMS messages.
• Keylogging: Code that logs keystrokes.
• Data Exfiltration: Code that sends data to a remote server.
• Root Detection: Code that checks for root access.

Example of SMS stealing code:

java

Telephony.Sms.getMessages(Telephony.Sms.InboxBox);

f. Examine Resources

Check for suspicious strings, images, or other resources that might indicate malicious behavior.

3. Dynamic Analysis

Dynamic analysis involves running the APK on a device or emulator to observe its behavior at runtime.

a. Set Up an Emulator or Device

Use an Android emulator or a physical device for dynamic analysis. Ensure USB debugging is enabled.

Get Mohammad Muddasir’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

sh

adb devices

b. Install the APK

Install the malicious APK on the device or emulator.

sh

adb install malicious_apk.apk

c. Monitor Network Traffic

Use tools like Wireshark or tcpdump to monitor network traffic and identify data exfiltration.

sh

adb shell tcpdump -i any -w /sdcard/traffic.pcap

d. Log System Calls

Use strace to log system calls made by the app.

sh

adb shell strace -p <pid>

e. Use Frida for Dynamic Instrumentation

Attach Frida to the running process to hook into functions and monitor API calls.

sh

frida -U -f com.malicious.app -l frida_script.js --no-pause

Example Frida script to monitor SMS reading:

javascript

// frida_script.js
Java.perform(function () {
    var SmsManager = Java.use('android.telephony.SmsManager');
    SmsManager.getDefault().query.sendTextMessage.implementation = function (destinationAddress, scAddress, text, sentIntent, deliveryIntent) {
        console.log('SMS sent to: ' + destinationAddress + ' with text: ' + text);
        return this.query.sendTextMessage(destinationAddress, scAddress, text, sentIntent, deliveryIntent);
    };
});

f. Analyze Logs and Behavior

Check the device logs for any suspicious activity.

sh

adb logcat

Look for unusual behavior, such as unexpected network activity, high battery usage, or unusual permissions being requested at runtime.

4. Identify Malicious Behavior

Based on your static and dynamic analysis, identify the malicious behavior of the APK. Common types of malware include:

• Spyware: Collects and transmits personal data.
• Adware: Displays unwanted advertisements.
• Ransomware: Encrypts user data and demands payment for decryption.
• Banking Trojans: Steal banking credentials and perform fraudulent transactions.
• Rootkits: Gain root access to the device and hide their presence.

5. Report Your Findings

Document your findings, including the tools used, analysis methods, and evidence of malicious behavior. Provide recommendations for mitigation or removal of the malware.

Additional Tools

• Android Malware Sandbox: Automated analysis of Android malware.
• APKTool: For decompiling and recompiling APKs.
• Bytecode Viewer: A Java decompiler and disassembler.
• Ghidra: A software reverse engineering framework.

By following these steps, you can perform a comprehensive malware analysis for an Android APK, identifying its malicious behavior and understanding its impact on the device.