<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Mobile Malware

## VirusTotal API v3
```bash
# File hash lookup
curl -s "https://www.virustotal.com/api/v3/files/{sha256}" \
  -H "x-apikey: $VT_API_KEY"

# Upload file for scanning
curl -s -X POST "https://www.virustotal.com/api/v3/files" \
  -H "x-apikey: $VT_API_KEY" -F "file=@target.apk"

# Get behavior report
curl -s "https://www.virustotal.com/api/v3/files/{id}/behaviours" \
  -H "x-apikey: $VT_API_KEY"
```

## APKiD
```bash
apkid target.apk                # Identify packers/obfuscators
apkid -r directory/              # Recursive scan
apkid --json target.apk         # JSON output
```

## YARA
```bash
yara rule.yar target.apk         # Single rule scan
yara -r rules/ target.apk        # Recursive rules directory
yara -s rule.yar target.apk      # Show matching strings
yara -c rule.yar directory/       # Count matches
```

## androguard
```bash
androguard permissions target.apk # List permissions
androguard analyze target.apk     # Interactive analysis shell
androguard cg target.apk          # Call graph
```

## Common Malware Indicators
| Indicator | Family Type |
|-----------|-------------|
| `AccessibilityService` + `SYSTEM_ALERT_WINDOW` | Banking trojan |
| `RECEIVE_SMS` + `SEND_SMS` + hidden launcher | SMS stealer |
| `CAMERA` + `RECORD_AUDIO` + `ACCESS_FINE_LOCATION` | Spyware |
| `BIND_DEVICE_ADMIN` + `SYSTEM_ALERT_WINDOW` | Ransomware |
| Anti-emulator checks + packing | Evasive malware |
