<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: analyzing-mobile-malware
description: >-
  Analyze Android and iOS malware samples through static and dynamic analysis.
  Covers APK/IPA decompilation, manifest analysis, runtime behavior monitoring,
  network traffic interception, and automated indicator extraction for mobile
  threat intelligence.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - mobile-malware
  - android
  - ios
  - apk-analysis
  - frida
  - jadx
  - reverse-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1404"]
---

# Analyzing Mobile Malware

## Overview

Mobile malware targets Android and iOS devices through trojanized apps, phishing
lures, and exploit chains. Analysis requires platform-specific tooling for
decompilation, permission auditing, runtime hooking, and network interception.
This skill covers the full analysis lifecycle from sample acquisition through
indicator extraction and reporting.

## Prerequisites

| Requirement | Install |
|---|---|
| jadx | `brew install jadx` — APK decompiler |
| apktool | `brew install apktool` — APK resource decoder |
| Frida | `pip install frida-tools` — Runtime instrumentation |
| androguard | `pip install androguard` — Python APK analysis |
| mitmproxy | `pip install mitmproxy` — Network interception |
| ADB | Android SDK Platform Tools |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Static Analysis — Android

#### APK Structure

```
sample.apk
├── AndroidManifest.xml    — Permissions, components, intent filters
├── classes.dex            — Dalvik bytecode (decompile with jadx)
├── res/                   — Resources, layouts, strings
├── lib/                   — Native libraries (.so files)
├── assets/                — Raw files (config, encrypted payloads)
└── META-INF/              — Signing certificates
```

#### Manifest Analysis

```bash
# Decode APK resources
apktool d sample.apk -o sample_decoded/

# Key checks in AndroidManifest.xml:
# - Dangerous permissions: SEND_SMS, READ_CONTACTS, CAMERA, RECORD_AUDIO
# - Device admin receiver (anti-uninstall)
# - Accessibility service (overlay attacks, keylogging)
# - Boot receiver (persistence)
# - Custom permissions with protectionLevel="signature"
```

#### Decompilation and Code Review

```bash
# Decompile to Java source
jadx -d output/ sample.apk

# Search for suspicious patterns
grep -rn "DexClassLoader\|InMemoryDexClassLoader" output/
grep -rn "Runtime.getRuntime().exec" output/
grep -rn "TelephonyManager\|getDeviceId\|getSubscriberId" output/
grep -rn "Cipher.getInstance\|SecretKeySpec" output/
grep -rn "http://\|https://" output/ | grep -v "schemas.android.com"
```

#### Certificate Analysis

```bash
# Extract signing certificate
apksigner verify --print-certs sample.apk

# Check with keytool
unzip -p sample.apk META-INF/CERT.RSA | keytool -printcert
```

### Dynamic Analysis — Android

#### Frida Runtime Hooking

```javascript
// Hook SSL pinning bypass
Java.perform(function() {
    var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    var SSLContext = Java.use('javax.net.ssl.SSLContext');

    var TrustManagerImpl = Java.registerClass({
        name: 'com.frida.TrustManager',
        implements: [TrustManager],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });

    SSLContext.init.overload(
        '[Ljavax.net.ssl.KeyManager;',
        '[Ljavax.net.ssl.TrustManager;',
        'java.security.SecureRandom'
    ).implementation = function(km, tm, sr) {
        this.init(km, [TrustManagerImpl.$new()], sr);
    };
});
```

```bash
# Attach Frida to running app
frida -U -f com.malware.sample -l ssl_bypass.js --no-pause

# Trace crypto operations
frida-trace -U -f com.malware.sample -j 'javax.crypto.*!*'

# Monitor file system access
frida-trace -U -f com.malware.sample -j 'java.io.File!*'
```

### Static Analysis — iOS

```bash
# Extract IPA contents
unzip sample.ipa -d sample_extracted/

# Analyze Mach-O binary
otool -L sample_extracted/Payload/App.app/App    # Linked libraries
strings sample_extracted/Payload/App.app/App      # Embedded strings
class-dump sample_extracted/Payload/App.app/App   # ObjC class headers

# Check entitlements
codesign -d --entitlements :- sample_extracted/Payload/App.app/
```

### Network Analysis

```bash
# Start mitmproxy for traffic capture
mitmproxy --mode transparent --ssl-insecure -w capture.flow

# Export captured flows
mitmdump -r capture.flow --set flow_detail=3

# Extract C2 domains from capture
mitmdump -r capture.flow -s extract_domains.py
```

### Indicator Extraction

| Indicator Type | Source | Tool |
|---|---|---|
| C2 domains/IPs | Network capture, decompiled strings | mitmproxy, grep |
| File hashes | APK, DEX, SO files | sha256sum |
| Certificates | APK signing cert, TLS pins | apksigner, openssl |
| Permissions | AndroidManifest.xml | apktool |
| API keys | Decompiled source, assets | jadx + grep |

## Workflow

1. **Acquire** — Obtain sample from sandbox, app store mirror, or incident
2. **Triage** — Hash, check VirusTotal, identify app package and version
3. **Static analysis** — Decompile, review manifest, extract strings and IOCs
4. **Dynamic analysis** — Run in emulator/device with Frida hooks and network capture
5. **Behavioral analysis** — Document C2 communication, data exfiltration, persistence
6. **IOC extraction** — Compile network indicators, file hashes, behavioral signatures
7. **Report** — Produce malware analysis report with MITRE ATT&CK mapping
8. **Share** — Submit IOCs to threat intelligence platforms

## Detection

```yaml
title: Mobile Malware Detection
id: 073c9915-7c2d-4bc8-90fd-ef3b0fd86cf5
status: experimental
description: Detects suspicious activity related to analyzing mobile malware techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*mobile*"
  condition: selection
level: high
tags:
  - attack.t1404
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

| Check | Method |
|---|---|
| APK decompiles cleanly | `jadx` exits without errors, Java source readable |
| Manifest parsed | All permissions and components enumerated |
| Frida attaches | Runtime hooks fire on target functions |
| Network captured | mitmproxy records HTTP/HTTPS traffic from app |
| IOCs extracted | Hash, domain, IP, certificate indicators documented |

## References

- [MITRE ATT&CK Mobile](https://attack.mitre.org/matrices/mobile/)
- [OWASP Mobile Security Testing Guide](https://mas.owasp.org/MASTG/)
- [Frida Documentation](https://frida.re/docs/)
- [androguard Documentation](https://androguard.readthedocs.io/)
