cuckoo-droid

CuckooDroid - Automated Android Malware Analysis. Contributed By Check Point Software Technologies LTD. CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files, CuckooDroid brigs to cuckoo the capabilities of execution and analysis of...

DroidDetective

🕵️ Un framework de análisis de malware para aplicaciones Android basado en machine learning. ☢️ DroidDetective es una herramienta Python para analizar aplicaciones Android APKs en busca de comportamientos y configuraciones potencialmente maliciosas. Al proporcionar una ruta a una aplicación archivo...

MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...

MalEval

MalEval Article: Is “Knowing It’s Malicious” Enough? Evaluating LLMs for Fine-Grained Malware Behavior Auditing Article DOI: 10.1145/3832187 MalEval is a framework for evaluating Android malware behavior reports generated by large language models. The code in this repository implements two...

amtracker

amtracker Android Malware Tracker This was originally part of a module for the framework that i'm constantly developing. The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use of LIEF to extract the C2 from the android...

maldrolyzer

maldrolyzer Simple framework to extract "actionable" data from Android malware C&Cs, phone numbers etc. Installation You have to install the following packets before you start using this project: Androguard git clone https://github.com/androguard/androguard; cd androguard; sudo python setup.py...

MalConfig

MalConfig This is part of a module for the framework that i'm constantly developing. Robots images are provided by robohash.org Flag icons are provided by famfamfam The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use...

avpass

AVPASS AVPASS is a tool for leaking the detection model of Android malware detection systems i.e., antivirus software, and bypassing their detection logics by using the leaked information coupled with APK obfuscation techniques. AVPASS is not limited to detection features used by detection system...

avpass

AVPASS AVPASS es una herramienta para filtrar el modelo de detección de sistemas de detección de malware Android es decir, software antivirus y eludir sus lógicas de detección utilizando la información filtrada junto con técnicas de ofuscación de APK. AVPASS no se limita a las características de...

silverboxcc

Reverse engineered android malware called Red Alert V2.0. At the time of analysis, there were no longer any C2 servers running and so we were unable to observe any traffic between the malware and the C2 server. So we figured out the C2 protocol and wrote this control panel. Bot's traffic from the...

LiveHiddenCamera

Live Hidden Camera Live Hidden Camera LHC is a library which record live video and audio from Android device without displaying a preview. Motivation I'm working on a research based Android Malware and decided to create a multi function RAT Remote Administration Tool. I was working on Live Stream...

engine

Droidefense 引擎 高级 Android 恶意软件分析框架 最新版本 下载 Droidefense 是什么 Droidefense （最初代号为 atom：a nalysis t hrough o bservation m achine，即通过观察机器进行分析）是用于 Android 应用/恶意软件分析/逆向工程的工具代号。它专注于安全问题和恶意软件研究人员日常工作中遇到的技巧。针对恶意软件包含反分析 例程的场景，Droidefense 试图绕过这些例程，直达代码和“不良行为”例程。这些技术有时包括虚拟机检测、模拟器检测、自证书检查、管道检测、跟踪器 PID 检查等。...

MalwareSourceCode

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page 免責事項： 適用される法律で許容される最大限の範囲において、vx-underground およびコンテンツを vx-underground に提出した関連会社は、間接的、偶発的、特別、結果的、懲罰的損害賠償、または直接間接を問わず発生した利益や収入の損失、データ、使用、のれん、その他の無形資産の損失について、以下の事由に起因する場合、一切の責任を負いません。i...

BIDO

BIDO This code belongs to "BIDO: A Unified Approach to Address Obfuscation and Concept Drift Challenges in Image-based Malware Detection". Author Author: Junhui Li1, Chengbin Feng2, Zhiwei Yang1, Qi Mo1 and Wei Wang1. Institution Institution1：Software School, Yunnan University, Kunming, Yunnan...

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic...

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

A previously unseen Android near field communication NFC relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan RAT called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to...

ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection

The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications. Although applications are required to undergo malware screening before being published on officia...

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors. In this work, we first show that, despite claims, existing problem-space attacks remain largely impractical. Most techniques leverage software transplantation to inject entire beni...

The Sound of Malware: A Memory Forensics Approach for Android Malware Analysis Via Audio Signals

Android malware analysis is currently facing increasing challenges in achieving robust classification and detecting stealth attacks. Modern threats employ advanced evasion strategies such as code obfuscation, dynamic loading, packing, and even steganographic manipulation of traditional static and...

Don't Trust Us: A Privacy-By-Design Android Malware Detection Pipeline

Android malware detection increasingly relies on collecting and processing sensitive user data, including device identifiers, network artifacts, and runtime traces, while privacy is too often treated as a secondary concern. Existing privacy-aware approaches typically enforce privacy after data...