MalConfig

MalConfig This is part of a module for the framework that i'm constantly developing. Robots images are provided by robohash.org Flag icons are provided by famfamfam The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use...

MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...

DroidDetective

🕵️ A machine learning malware analysis framework for Android apps. ☢️ DroidDetective is a Python tool for analysing Android applications APKs for potential malware related behaviour and configurations. When provided with a path to an application APK file Droid Detective will make a prediction using...

amtracker

amtracker Android Malware Tracker This was originally part of a module for the framework that i'm constantly developing. The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use of LIEF to extract the C2 from the android...

engine

Droidefense Engine 고급 Android 악성코드 분석 프레임워크 최신 릴리스 다운로드 Droidefense란? Droidefense 원래 이름은 atom: a nalysis t hrough o bservation m achine는 Android 앱/악성코드 분석/리버싱 도구의 코드명입니다. 이 도구는 악성코드 연구원들이 일상 업무에서 직면하는 보안 문제와 트릭에 중점을 두고 구축되었습니다. 악성코드에 안티 분석 루틴이 있는 상황에서 Droidefense는 이를 우회하여 코드와 'bad boy' 루틴에 접근하려고...

avpass

AVPASS AVPASS — это инструмент для утечки модели обнаружения систем детектирования вредоносных приложений Android т.е. антивирусного ПО и обхода их логики обнаружения с использованием утекшей информации в сочетании с методами обфускации APK. AVPASS не ограничивается признаками обнаружения,...

avpass

AVPASS AVPASS is a tool for leaking the detection model of Android malware detection systems i.e., antivirus software, and bypassing their detection logics by using the leaked information coupled with APK obfuscation techniques. AVPASS is not limited to detection features used by detection system...

LiveHiddenCamera

Live Hidden Camera Live Hidden Camera LHC is a library which record live video and audio from Android device without displaying a preview. Motivation I'm working on a research based Android Malware and decided to create a multi function RAT Remote Administration Tool. I was working on Live Stream...

cuckoo-droid

CuckooDroid - Автоматизированный анализ вредоносных программ для Android. Предоставлено компанией Check Point Software Technologies LTD. CuckooDroid является расширением Cuckoo Sandbox — программного обеспечения с открытым исходным кодом для автоматизации анализа подозрительных файлов. CuckooDroi...

silverboxcc

Malware Android sottoposto a reverse engineering chiamato Red Alert V2.0. Al momento dell'analisi, non erano più in esecuzione server C2, quindi non siamo stati in grado di osservare alcun traffico tra il malware e il server C2. Così abbiamo ricostruito il protocollo C2 e scritto questo pannello ...

MalwareSourceCode

gestito da vx-underground | seguici su Twitter | scarica campioni di malware alla pagina VXUG/samples Limitazione di responsabilità: Nella misura massima consentita dalla legge applicabile, vx-underground e/o gli affiliati che hanno inviato contenuti a vx-underground non saranno ritenuti...

MalEval

MalEval Articolo: Basta “sapere che è dannoso”? Valutare gli LLM per l'audit granulare del comportamento del malware DOI dell'articolo: 10.1145/3832187 MalEval è un framework per valutare i report sul comportamento del malware Android generati da grandi modelli linguistici. Il codice in questo...

maldrolyzer

maldrolyzer Estrutura simples para extrair dados "acionáveis" de malware Android C&Cs, números de telefone etc. Instalação Você precisa instalar os seguintes pacotes antes de começar a usar este projeto: Androguard git clone https://github.com/androguard/androguard; cd androguard; sudo python...

BIDO

BIDO Questo codice appartiene a "BIDO: Un approccio unificato per affrontare l'offuscamento degli indirizzi e le sfide della deriva concettuale nel rilevamento di malware basato su immagini". Autore Autore: Junhui Li1, Chengbin Feng2, Zhiwei Yang1, Qi Mo1 e Wei Wang1. Istituzione...

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic...

ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection

The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on officia...

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors. In this work, we first show that, despite claims, existing problem-space attacks remain largely impractical. Most techniques leverage software transplantation to inject entire beni...

The Sound of Malware: A Memory Forensics Approach for Android Malware Analysis Via Audio Signals

Android malware analysis is currently facing increasing challenges in achieving robust classification and detecting stealth attacks. Modern threats employ advanced evasion strategies such as code obfuscation, dynamic loading, packing, and even steganographic manipulation of traditional static and...

Don't Trust Us: A Privacy-By-Design Android Malware Detection Pipeline

Android malware detection increasingly relies on collecting and processing sensitive user data, including device identifiers, network artifacts, and runtime traces, while privacy is too often treated as a secondary concern. Existing privacy-aware approaches typically enforce privacy after data...

Adversarial Vulnerability under Temporal Concept Drift: A Longitudinal Study of Android Malware Detection

We present a longitudinal, drift-aware evaluation of adversarial robustness across more than a decade of Android applications using static and dynamic feature representations extracted from emulator and real-device executions. The dataset is organized into yearly slices and evaluated under three...