maldrolyzer

maldrolyzer Simple framework to extract "actionable" data from Android malware C&Cs, phone numbers etc. Installation You have to install the following packets before you start using this project: Androguard git clone https://github.com/androguard/androguard; cd androguard; sudo python setup.py...

silverboxcc

Reverse engineered android malware called Red Alert V2.0. At the time of analysis, there were no longer any C2 servers running and so we were unable to observe any traffic between the malware and the C2 server. So we figured out the C2 protocol and wrote this control panel. Bot's traffic from the...

BIDO

BIDO This code belongs to "BIDO: A Unified Approach to Address Obfuscation and Concept Drift Challenges in Image-based Malware Detection". Author Author: Junhui Li1, Chengbin Feng2, Zhiwei Yang1, Qi Mo1 and Wei Wang1. Institution Institution1：Software School, Yunnan University, Kunming, Yunnan...

LiveHiddenCamera

Live Hidden Camera Live Hidden Camera LHC is a library which record live video and audio from Android device without displaying a preview. Motivation I'm working on a research based Android Malware and decided to create a multi function RAT Remote Administration Tool. I was working on Live Stream...

DroidDetective

🕵️ A machine learning malware analysis framework for Android apps. ☢️ DroidDetective is a Python tool for analysing Android applications APKs for potential malware related behaviour and configurations. When provided with a path to an application APK file Droid Detective will make a prediction using...

amtracker

amtracker Android Malware Tracker This was originally part of a module for the framework that i'm constantly developing. The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use of LIEF to extract the C2 from the android...

MalConfig

MalConfig This is part of a module for the framework that i'm constantly developing. Robots images are provided by robohash.org Flag icons are provided by famfamfam The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use...

cuckoo-droid

CuckooDroid - Automated Android Malware Analysis. Contributed By Check Point Software Technologies LTD. CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files, CuckooDroid brigs to cuckoo the capabilities of execution and analysis of...

MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...

avpass

AVPASS AVPASS is a tool for leaking the detection model of Android malware detection systems i.e., antivirus software, and bypassing their detection logics by using the leaked information coupled with APK obfuscation techniques. AVPASS is not limited to detection features used by detection system...

MalEval

MalEval Article: Is “Knowing It’s Malicious” Enough? Evaluating LLMs for Fine-Grained Malware Behavior Auditing Article DOI: 10.1145/3832187 MalEval is a framework for evaluating Android malware behavior reports generated by large language models. The code in this repository implements two...

engine

Droidefense Engine Marco Avanzado de Análisis de Malware Android Última versión Descargar Qué es Droidefense Droidefense originalmente llamado atom: a nalysis t hrough o bservation m achine es el nombre clave de una herramienta de análisis/ingeniería inversa de aplicaciones/malware Android. Fue...

avpass

AVPASS AVPASS es una herramienta para filtrar el modelo de detección de sistemas de detección de malware Android es decir, software antivirus y eludir sus lógicas de detección utilizando la información filtrada junto con técnicas de ofuscación de APK. AVPASS no se limita a las características de...

MalwareSourceCode

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page 免責事項： 適用される法律で許容される最大限の範囲において、vx-underground およびコンテンツを vx-underground に提出した関連会社は、間接的、偶発的、特別、結果的、懲罰的損害賠償、または直接間接を問わず発生した利益や収入の損失、データ、使用、のれん、その他の無形資産の損失について、以下の事由に起因する場合、一切の責任を負いません。i...

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer...

HYDRA: Proactive Android Malware Drift Adaptation Via Hierarchical Graph Contrastive Learning

Concept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are...

Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models LLMs offer strong semantic understandi...

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic...

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

A previously unseen Android near field communication NFC relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan RAT called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to...

New Android malware lets criminals use your bank card in real time

Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it "WindRelay." NFC Near Field Communication is wireless technology that allows devices such as smartphones, payment cards,...