<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-mobile-malware
description: >-
  Identify and analyze malicious mobile applications through behavioral analysis,
  signature scanning, permission anomaly detection, and sandboxed execution.
  Covers Android and iOS malware families, C2 communication patterns, and
  threat intelligence integration.
domain: cybersecurity
subdomain: mobile-security
tags:
  - malware
  - mobile-malware
  - android-malware
  - threat-detection
  - mobsf
  - virustotal
  - yara
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1407", "T1409", "T1417", "T1422"]
  owasp-mobile: ["M1", "M8"]
  tools: ["mobsf", "virustotal", "yara", "androguard", "apkid"]
---

# Detecting Mobile Malware

## Overview

Mobile malware detection combines static signature matching, behavioral analysis,
permission anomaly detection, and network traffic inspection to identify trojans,
spyware, adware, ransomware, and banking malware on Android and iOS platforms.

## Prerequisites

```bash
pip install androguard yara-python
pip install apkid            # APK identifier
# VirusTotal API key for hash lookups
# MobSF instance for automated scanning
```

## Workflow

### Step 1: Hash and Signature Checks

```bash
# Generate hashes
sha256sum target.apk
md5sum target.apk

# VirusTotal lookup
curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum target.apk | cut -d' ' -f1)" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

# APKiD — identify packers, obfuscators, anti-analysis
apkid target.apk
```

### Step 2: YARA Rule Scanning

```yaml
# mobile_malware.yar
rule Android_Banker {
    meta:
        description = "Generic Android banking trojan"
        author = "NERF"
    strings:
        $overlay = "TYPE_APPLICATION_OVERLAY"
        $accessibility = "AccessibilityService"
        $sms = "android.provider.Telephony.SMS_RECEIVED"
        $keylog = "onAccessibilityEvent"
    condition:
        3 of them
}

rule Android_Spyware {
    meta:
        description = "Android spyware indicators"
    strings:
        $camera = "android.permission.CAMERA"
        $mic = "android.permission.RECORD_AUDIO"
        $location = "android.permission.ACCESS_FINE_LOCATION"
        $sms_read = "android.permission.READ_SMS"
        $contacts = "android.permission.READ_CONTACTS"
        $hidden = "android.intent.category.LAUNCHER"
    condition:
        4 of ($camera, $mic, $location, $sms_read, $contacts) and not $hidden
}
```

```bash
yara mobile_malware.yar target.apk
yara -r mobile_malware.yar ./apps_directory/
```

### Step 3: Permission Anomaly Detection

```bash
# Extract permissions with androguard
androguard permissions target.apk

# High-risk permission combos (spyware indicators)
# CAMERA + RECORD_AUDIO + ACCESS_FINE_LOCATION + READ_SMS
# BIND_ACCESSIBILITY_SERVICE + SYSTEM_ALERT_WINDOW
# RECEIVE_SMS + SEND_SMS + READ_SMS (SMS stealer)
# BIND_DEVICE_ADMIN + SYSTEM_ALERT_WINDOW (ransomware)

# Check for permissions not matching app category
grep -c 'uses-permission' apktool_out/AndroidManifest.xml
```

### Step 4: Behavioral Indicators

```bash
# Dynamic execution in sandbox
# Check for C2 communication patterns
grep -rn 'HttpURLConnection\|OkHttp\|Retrofit' jadx_out/ | head -20

# Check for data exfiltration
grep -rn 'getDeviceId\|getSubscriberId\|getLine1Number' jadx_out/
grep -rn 'getAccounts\|READ_CONTACTS\|READ_CALL_LOG' jadx_out/

# Check for evasion techniques
grep -rn 'isEmulator\|Build.FINGERPRINT\|ro.hardware' jadx_out/
grep -rn 'Debug.isDebuggerConnected\|TracerPid' jadx_out/

# Check for persistence mechanisms
grep -rn 'BOOT_COMPLETED\|BIND_DEVICE_ADMIN' apktool_out/AndroidManifest.xml
grep -rn 'AlarmManager\|JobScheduler\|WorkManager' jadx_out/
```

### Step 5: Network C2 Detection

```bash
# Extract URLs and IPs from binary
strings target.apk | grep -E 'https?://' | sort -u
strings target.apk | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u

# Check domains against threat intel
# Use VirusTotal, OTX, or AbuseIPDB for reputation checks

# DGA detection — look for algorithmic domain generation
grep -rn 'Random\|MessageDigest\|\.toHexString' jadx_out/ | grep -i domain
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Known hash | VirusTotal | APK hash matches known malware |
| Packer/obfuscator | APKiD | Commercial or custom packing |
| Permission anomaly | Manifest | Excessive dangerous permissions |
| C2 communication | Network | Beaconing to known bad IPs |
| Evasion code | Source | Emulator/debugger detection |

```yaml
title: Mobile Malware Detection
id: 70e5639f-ae2e-4e80-b2a3-31e21ad5d77e
status: experimental
description: Detects suspicious activity related to detecting mobile malware techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407
  - attack.t1409
  - attack.t1417
  - attack.t1422
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] APK hash checked against VirusTotal
- [ ] YARA rules scanned for known signatures
- [ ] Permission analysis completed for anomalies
- [ ] Behavioral indicators cataloged
- [ ] Network IOCs extracted and reputation-checked
- [ ] APKiD packer/obfuscator detection run

## References

- [OWASP MASTG — Malware Analysis](https://mas.owasp.org/MASTG/)
- [VirusTotal API](https://docs.virustotal.com/reference/overview)
- [APKiD](https://github.com/rednaga/APKiD)
- [MITRE Mobile ATT&CK](https://attack.mitre.org/matrices/mobile/)
