<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Mobile Banking Trojans

## Androguard Analysis
```python
from androguard.misc import AnalyzeAPK
a, d, dx = AnalyzeAPK("suspect.apk")
a.get_permissions()                      # List permissions
a.get_activities()                       # List activities
a.get_services()                         # List services
a.get_receivers()                        # List broadcast receivers
```

## YARA Rule Template
```yara
rule BankingTrojan_Generic {
    meta:
        description = "Generic mobile banking trojan indicators"
        author = "defconxt"
    strings:
        $acc = "AccessibilityService" ascii
        $overlay = "TYPE_APPLICATION_OVERLAY" ascii
        $sms = "SMS_RECEIVED" ascii
        $admin = "DeviceAdminReceiver" ascii
        $inject = "injectView" ascii
    condition:
        3 of them
}
```

## Frida Hooks
```javascript
// Hook Accessibility events
Java.perform(function() {
    var AS = Java.use("android.accessibilityservice.AccessibilityService");
    AS.onAccessibilityEvent.implementation = function(event) {
        console.log("[*] AccessibilityEvent: " + event.getEventType()
            + " pkg=" + event.getPackageName());
        this.onAccessibilityEvent(event);
    };
});

// Hook WindowManager.addView for overlay detection
Java.perform(function() {
    var WM = Java.use("android.view.WindowManagerImpl");
    WM.addView.implementation = function(view, params) {
        console.log("[*] addView type=" + params.type.value);
        this.addView(view, params);
    };
});
```

## tshark C2 Analysis
```bash
tshark -r capture.pcap -Y 'dns' -T fields -e dns.qry.name | sort -u
tshark -r capture.pcap -Y 'http' -T fields -e http.host -e http.request.uri
tshark -r capture.pcap -Y 'tls.handshake' -T fields -e tls.handshake.extensions_server_name
tshark -r capture.pcap -qz conv,tcp                    # TCP conversations
```

## Known Trojan Families
| Family | Key Indicators |
|--------|---------------|
| Anatsa | Accessibility overlay, DGA C2 |
| Cerberus | Screen recording, overlay, SMS theft |
| SharkBot | ATS fraud, overlay injection |
| Hydra | Accessibility keylogging, screen streaming |
| Xenomorph | Overlay, cookie stealing, 2FA bypass |
