pip install androguard yara-python
pip install apkid            # APK identifier
# VirusTotal API key for hash lookups
# MobSF instance for automated scanning

# Generate hashes
sha256sum target.apk
md5sum target.apk

# VirusTotal lookup
curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum target.apk | cut -d' ' -f1)" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

# APKiD — identify packers, obfuscators, anti-analysis
apkid target.apk

# mobile_malware.yar
rule Android_Banker {
    meta:
        description = "Generic Android banking trojan"
        author = "CIPHER"
    strings:
        $overlay = "TYPE_APPLICATION_OVERLAY"
        $accessibility = "AccessibilityService"
        $sms = "android.provider.Telephony.SMS_RECEIVED"
        $keylog = "onAccessibilityEvent"
    condition:
        3 of them
}

rule Android_Spyware {
    meta:
        description = "Android spyware indicators"
    strings:
        $camera = "android.permission.CAMERA"
        $mic = "android.permission.RECORD_AUDIO"
        $location = "android.permission.ACCESS_FINE_LOCATION"
        $sms_read = "android.permission.READ_SMS"
        $contacts = "android.permission.READ_CONTACTS"
        $hidden = "android.intent.category.LAUNCHER"
    condition:
        4 of ($camera, $mic, $location, $sms_read, $contacts) and not $hidden
}

yara mobile_malware.yar target.apk
yara -r mobile_malware.yar ./apps_directory/

# Extract permissions with androguard
androguard permissions target.apk

# High-risk permission combos (spyware indicators)
# CAMERA + RECORD_AUDIO + ACCESS_FINE_LOCATION + READ_SMS
# BIND_ACCESSIBILITY_SERVICE + SYSTEM_ALERT_WINDOW
# RECEIVE_SMS + SEND_SMS + READ_SMS (SMS stealer)
# BIND_DEVICE_ADMIN + SYSTEM_ALERT_WINDOW (ransomware)

# Check for permissions not matching app category
grep -c 'uses-permission' apktool_out/AndroidManifest.xml

# Dynamic execution in sandbox
# Check for C2 communication patterns
grep -rn 'HttpURLConnection\|OkHttp\|Retrofit' jadx_out/ | head -20

# Check for data exfiltration
grep -rn 'getDeviceId\|getSubscriberId\|getLine1Number' jadx_out/
grep -rn 'getAccounts\|READ_CONTACTS\|READ_CALL_LOG' jadx_out/

# Check for evasion techniques
grep -rn 'isEmulator\|Build.FINGERPRINT\|ro.hardware' jadx_out/
grep -rn 'Debug.isDebuggerConnected\|TracerPid' jadx_out/

# Check for persistence mechanisms
grep -rn 'BOOT_COMPLETED\|BIND_DEVICE_ADMIN' apktool_out/AndroidManifest.xml
grep -rn 'AlarmManager\|JobScheduler\|WorkManager' jadx_out/

# Extract URLs and IPs from binary
strings target.apk | grep -E 'https?://' | sort -u
strings target.apk | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u

# Check domains against threat intel
# Use VirusTotal, OTX, or AbuseIPDB for reputation checks

# DGA detection — look for algorithmic domain generation
grep -rn 'Random\|MessageDigest\|\.toHexString' jadx_out/ | grep -i domain

title: Mobile Malware Detection
id: 70e5639f-ae2e-4e80-b2a3-31e21ad5d77e
status: experimental
description: Detects suspicious activity related to detecting mobile malware techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407
  - attack.t1409
  - attack.t1417
  - attack.t1422
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies