Reverse Engineering of Modern Android Malware

2 Day u_short 16 CPE Hour Training: August 2021


## Abstract In this workshop, you will learn how to analyze Android malware and understand what they are doing. The workshop consists in a majority of hands-on lab sessions, with demo and many exercises on real, and recent, Android malware. Of course, you also learn how to deal with those malware safely ;-) #### Malware Samples covered during the training * Android/Alien * Android/Bread (Joker) * Android/EventBot * Android/Ghimob * Android/SpyNote * Android/Sandr (Sandro RAT) ## Agenda #### Session 1: Android background and first steps * Introduction / Welcome * Android malware trends * Google Play Protect * Contents of Android application: manifest, assets, native libraries... * Certificates and application signature * Presentation of Reverse Engineering tools * Setup of tools. A dedicated Docker container is provided to attendees * 3 Labs: compiling an Android app, disassembling it and patching. #### Session 2: Reverse engineering of Android Malware * Demo of reverse engineering of Android/SpyNote * Exercises on other samples * Using Quark Engine to spot malicious behaviour * Writing custom rules for Quark Engine * Using MobSF for an overview and quick analysis of a sample #### Session 3: Dynamic loading and obfuscation * Dynamically loaded classes * Unpacking packed malware with Dexcalibur * Decrypting obfuscating string with Frida #### Session 4: Advanced reverse engineering * De-obfuscation like a Pro * Using House * Implementing a JEB script * Malware abusing Accessibility Services * Anti-debug/VM tricks and solutions based * Detection with APKiD * Modifying default Dexcalibur hooks * SSdeep and dexofuzzy to find similar samples #### Session 5: Malicious network activity * Locating the CnC of a malware * Reversing the contents of an obfuscated HTTP Post * Searching through classes with Smalisca * Re-activating debug messages with a Frida hook * Dealing with native libraries #### Tools used during the training * Androguard * Android Studio * APKiD * Apksigner * APKTool * Baksmali / Smali * Dexcalibur * Frida * House * JADX * JD-GUI * JEB * MobSF * Quark * Smalisca * Pithus ## Required Skills * Familiarity with Unix command-line tools * Basic understanding of Java programming concepts (classes, methods, inheritance, etc.) * Be able to write scripts or small programs in a language of your choice (e.g. Python, Java, etc.) * OPTIONAL: Familiarity with Docker: pull images, run containers, configure ports and shared directories. This is not strictly mandatory knowledge for the training, but it will help. ## System Requirements * A working laptop capable of running virtual machines * 15 GB free Hard disk space * Docker and docker-compose: https://docs.docker.com * Training container: 'docker pull cryptax/android-re:latest' * SSH, SCP and/or VNC client * Recent Java Development Kit (JDK) * Android Studio: https://developer.android.com/studio/ * Python 3.x * A programming environment of your choice - Vim, Emacs, Sublime, etc. * A build environment * Discord
Axelle Apvrille

Axelle Apvrille

Register Now

Axelle is Principal Security Researcher at Fortinet, where she focuses on malware analysis for smartphones and other smart devices (IoT). She has presented at numerous conferences such as Virus Bulletin, Black Hat Europe, RSA, Troopers, typically on mobile malware, medical malware and IoT hacking. She enjoyed giving several workshops at Hack.Lu, Nuit du Hack and Insomni'hack. Axelle is also the lead organizer for [Ph0wn CTF](https://ph0wn.org/), an on-site Capture The Flag event dedicated to smart devices. She enjoys both creating challenges for Ph0wn, or playing other CTFs. Before joining Fortinet (12 years ago!), Axelle worked for 10 years on the implementation of cryptographic algorithms and security protocols. This is probably where her handle "cryptax" (twitter) or "cryptogirl" comes from. In those ancient days, she was a lecturer in French engineering schools. A complete list of her talks and papers can be found at http://wikisec.free.fr/papers/papers.html