Android与iOS移动恶意程序分析

---
name: mobile-malware-analysis
description: >
  Analyze Android and iOS malware samples through APK decompilation, manifest
  permission analysis, source code review, native library inspection, and
  root/jailbreak detection bypass. Use when investigating suspicious mobile
  applications, identifying data exfiltration, detecting C2 communication,
  analyzing obfuscated payloads, or reverse-engineering anti-analysis techniques.
  Supports both static and dynamic analysis workflows.
---

# Mobile Malware Analysis

Investigate suspicious Android and iOS applications by decompiling APKs,
analyzing manifest permissions, reviewing decompiled source code, inspecting
native libraries, and identifying anti-analysis techniques such as root
detection and certificate pinning.

## Prerequisites

- **Linux**: `python3`, `unzip`, `file`, `strings`, `openssl`
- **Android tools**: `jadx`, `apktool`, `dex2jar`, `aapt2`, `adb`
- **iOS tools**: `class-dump`, `otool`, `ldid`, `jtool2`
- **Python packages**: `androguard`, `lxml`, `hashlib`, `argparse` (standard library)
- **Dynamic analysis**: Frida, objection, Magisk (for rooted devices), Burp Suite
- **Emulators**: Android Studio AVD, Genymotion, Corellium (iOS)

## Step-by-Step Instructions

### Step 1: Initial APK Triage

Collect basic information about the APK before deep analysis.

**Calculate hashes and identify file type:**
```bash
sha256sum suspicious.apk
file suspicious.apk
unzip -l suspicious.apk | head -30
```

**Use the APK analyzer script for automated triage:**
```bash
python3 scripts/apk_analyzer.py --apk suspicious.apk --output report.json
python3 scripts/apk_analyzer.py --apk suspicious.apk --extract-urls --extract-ips
python3 scripts/apk_analyzer.py --apk suspicious.apk --check-native --verbose
```

**Extract basic info with aapt2:**
```bash
aapt2 dump badging suspicious.apk
aapt2 dump permissions suspicious.apk
```

### Step 2: Decompile and Examine the Manifest

Decompile the APK and analyze the AndroidManifest.xml for security issues.

**Decompile with jadx:**
```bash
jadx -d output_dir suspicious.apk
# Or for resources only:
apktool d suspicious.apk -o apktool_output
```

**Run the manifest checker:**
```bash
python3 scripts/manifest_checker.py --manifest output_dir/resources/AndroidManifest.xml
python3 scripts/manifest_checker.py --apk suspicious.apk --output findings.json
```

**Key manifest elements to examine:**
| Element | Security Concern |
|---|---|
| `android:debuggable="true"` | Debug build leaked or intentional backdoor |
| `android:allowBackup="true"` | Data extractable via adb backup |
| `android:usesCleartextTraffic="true"` | Allows unencrypted HTTP traffic |
| Exported components without permissions | Accessible by other apps |
| Custom permissions with `normal` protection | Easily grantable by any app |
| `BIND_DEVICE_ADMIN` | Device administrator capabilities |
| `SYSTEM_ALERT_WINDOW` | Overlay attacks (tapjacking) |

### Step 3: Analyze Permissions

Review requested permissions for indicators of malicious intent.

**Dangerous permission categories:**
| Category | Permissions | Malware Use |
|---|---|---|
| SMS | `SEND_SMS`, `RECEIVE_SMS`, `READ_SMS` | Premium SMS fraud, OTP interception |
| Location | `ACCESS_FINE_LOCATION`, `ACCESS_BACKGROUND_LOCATION` | Stalkerware, tracking |
| Camera/Mic | `CAMERA`, `RECORD_AUDIO` | Spyware, surveillance |
| Contacts | `READ_CONTACTS`, `WRITE_CONTACTS` | Data harvesting, worm spreading |
| Storage | `READ_EXTERNAL_STORAGE`, `MANAGE_EXTERNAL_STORAGE` | Data theft, ransomware |
| Phone | `READ_PHONE_STATE`, `CALL_PHONE`, `READ_CALL_LOG` | Call interception, IMEI theft |
| Accessibility | `BIND_ACCESSIBILITY_SERVICE` | Keylogging, UI automation |

**Check for permission escalation patterns:**
- Accessibility service abuse for keylogging or overlay attacks
- Device admin for anti-uninstall persistence
- Usage stats for app monitoring
- Notification listener for intercepting notifications

See `references/mobile-permissions.md` for the complete dangerous permissions reference.

### Step 4: Review Decompiled Source Code

Examine the decompiled Java/Kotlin code for malicious behavior.

**Search for C2 communication:**
```bash
grep -rn "HttpURLConnection\|OkHttp\|Retrofit\|Volley" output_dir/sources/
grep -rn "URL\|URI\|openConnection" output_dir/sources/
grep -rn "getInputStream\|getOutputStream" output_dir/sources/
```

**Search for data exfiltration:**
```bash
grep -rn "getDeviceId\|getSubscriberId\|getLine1Number" output_dir/sources/
grep -rn "getAccounts\|ContactsContract" output_dir/sources/
grep -rn "SmsManager\|sendTextMessage\|sendMultipartTextMessage" output_dir/sources/
```

**Search for dynamic code loading:**
```bash
grep -rn "DexClassLoader\|PathClassLoader\|InMemoryDexClassLoader" output_dir/sources/
grep -rn "loadClass\|forName\|getMethod\|invoke" output_dir/sources/
grep -rn "Runtime.getRuntime().exec\|ProcessBuilder" output_dir/sources/
```

**Search for obfuscation indicators:**
```bash
# Single-character class/method names (ProGuard/R8)
find output_dir/sources -name "?.java" | head -20
# String encryption
grep -rn "decrypt\|cipher\|AES\|DES\|Base64.decode" output_dir/sources/
# Reflection-based calls
grep -rn "getDeclaredMethod\|setAccessible\|getDeclaredField" output_dir/sources/
```

### Step 5: Inspect Native Libraries

Analyze native shared libraries (.so files) for hidden functionality.

**List native libraries:**
```bash
unzip -l suspicious.apk | grep "\.so$"
# Common architectures: armeabi-v7a, arm64-v8a, x86, x86_64
```

**Extract and analyze:**
```bash
unzip suspicious.apk "lib/*" -d extracted/
file extracted/lib/arm64-v8a/*.so
strings extracted/lib/arm64-v8a/libnative.so | grep -iE "http|socket|exec|system|dlopen"
```

**Check for JNI function exports:**
```bash
readelf -sW extracted/lib/arm64-v8a/libnative.so | grep "Java_"
# Or use nm:
nm -D extracted/lib/arm64-v8a/libnative.so | grep " T " | head -20
```

**Suspicious native library indicators:**
- Libraries not matching the app's stated purpose
- Anti-debugging: `ptrace`, `inotify`, `/proc/self/status`
- Root detection: `su`, `Superuser.apk`, `Magisk`
- Emulator detection: `goldfish`, `generic`, `sdk`
- Encryption routines without clear purpose
- Socket operations in libraries that shouldn't need them

### Step 6: Detect Anti-Analysis Techniques

Identify and bypass root detection, emulator detection, and debugging checks.

**Common root detection methods:**
```java
// File-based checks
new File("/system/app/Superuser.apk").exists()
new File("/system/xbin/su").exists()
new File("/data/local/bin/su").exists()

// Property checks
Runtime.getRuntime().exec("getprop ro.build.tags")  // "test-keys"

// Package checks
getPackageManager().getPackageInfo("com.topjohnwu.magisk", 0)
getPackageManager().getPackageInfo("eu.chainfire.supersu", 0)
```

**Common emulator detection:**
```java
Build.FINGERPRINT.contains("generic")
Build.MODEL.contains("Emulator")
Build.HARDWARE.contains("goldfish")
new File("/dev/qemu_pipe").exists()
```

**Bypass with Frida:**
```bash
# Hook root detection
frida -U -f com.suspicious.app -l bypass_root.js --no-pause

# Hook SSL pinning
frida -U -f com.suspicious.app -l ssl_bypass.js --no-pause

# Use objection for automated bypass
objection -g com.suspicious.app explore
# Then: android sslpinning disable
# Then: android root disable
```

**Dynamic instrumentation with Frida:**
```javascript
// Hook a method to observe arguments and return values
Java.perform(function() {
    var TargetClass = Java.use("com.suspicious.app.ClassName");
    TargetClass.methodName.implementation = function(arg1) {
        console.log("Called with: " + arg1);
        var result = this.methodName(arg1);
        console.log("Returned: " + result);
        return result;
    };
});
```

### Step 7: Network Traffic Analysis

Capture and analyze the app's network communications.

**Set up traffic interception:**
```bash
# Configure Burp Suite proxy on device/emulator
# For certificate pinning bypass, use Frida or objection

# Capture with mitmproxy
mitmproxy --mode transparent --listen-port 8080

# Capture with tcpdump on device (requires root)
adb shell tcpdump -w /sdcard/capture.pcap
adb pull /sdcard/capture.pcap
```

**Analyze captured traffic:**
```bash
# Look for C2 communication patterns
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri
# Check for DNS queries
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u
# Look for non-standard ports
tshark -r capture.pcap -Y "tcp.dstport > 1024" -T fields -e ip.dst -e tcp.dstport | sort -u
```

### Step 8: iOS-Specific Analysis

For iOS malware, additional techniques are needed.

**Decrypt and analyze IPA:**
```bash
# Decrypt app binary (on jailbroken device)
# Use frida-ios-dump or clutch
frida-ios-dump -u <bundle_id>

# Analyze Mach-O binary
otool -L decrypted_binary        # List linked libraries
otool -hv decrypted_binary       # Header info
class-dump decrypted_binary > headers.h  # Extract class definitions
strings decrypted_binary | grep -iE "http|api|key|token|secret"
```

**Check for private API usage:**
```bash
# Private APIs indicate potential App Store policy violations or malicious intent
nm decrypted_binary | grep -i "private\|_CT\|_UI"
class-dump decrypted_binary | grep -iE "LSApplicationWorkspace|SBUserNotification"
```

**iOS persistence mechanisms:**
- MDM profiles for configuration control
- Enterprise certificates for sideloading
- Keyboard extensions for keylogging
- VPN profiles for traffic interception
- Background app refresh abuse

## Output Format

Document findings in a structured format:

```json
{
  "sample": {
    "filename": "suspicious.apk",
    "sha256": "abc123...",
    "package_name": "com.suspicious.app",
    "version": "1.0.0",
    "min_sdk": 21,
    "target_sdk": 33
  },
  "permissions": {
    "dangerous": ["SEND_SMS", "READ_CONTACTS", "CAMERA"],
    "risk_assessment": "high"
  },
  "components": {
    "exported_activities": [],
    "exported_services": [],
    "exported_receivers": [],
    "content_providers": []
  },
  "network_indicators": {
    "urls": [],
    "ips": [],
    "domains": []
  },
  "native_libraries": [],
  "anti_analysis": {
    "root_detection": true,
    "emulator_detection": true,
    "ssl_pinning": true,
    "obfuscation": "ProGuard/R8"
  },
  "malware_family": "",
  "mitre_attack_mobile": [],
  "iocs": {}
}
```

## Tips

- Always analyze APKs in an isolated environment or emulator
- Check the signing certificate for known malicious signers
- Look for multiple DEX files (multidex) which may hide payloads
- Assets and raw resources directories may contain encrypted payloads
- Firebase/Google services configuration files may reveal project IDs
- Check for WebView JavaScript interfaces that expose native functions
- Shared preferences and SQLite databases may contain C2 configuration
- Use MobSF (Mobile Security Framework) for automated scanning
- Compare with known-good versions of the app if available