Android Malware Analysis Overview: Reverse Engineering and Threat Actor Profiling Process

Hi everyone, I would like to share my way of doing Android malware analysis and investigation, definitely not the best methodology but sharing is caring.

Dynamic Analysis

Usually, I start with dynamic analysis (usually but most of the time I do it concurrently with static analysis) to understand the behavior of the malware & it easier to understand what is going on and it help me creating my mind map on how the malware execute and data I/O.

Meanwhile, I use Burp Suite, ADB Logcat and interaction in emulator running concurrently and monitor the output the application generated and printed on the logcat. Why I do this?

• To observe its network activity, every HTTP connection it make to command and control  (C2) server.
• Any log created and behavior of the malware.
• Tracing functionality of the malware, what logcat and system react to the application.
• I screenshot everything what is happening on the screen.
• Extract data generated by application.
• Running processes (ps, top etc).
• Checking method of persistent used by the malware.

This is important. Take note on what is happening and I find using paper & pen really do the job and very satisfying. It's OK if no one understands what you write in your note, I create my note and nobody can read it because of my ugly handwriting with all the sketch I do to create the flow but whatever helps for me to make my report as detailed as possible later.

After finishing execute the application to get the its runtime context and completing dynamic analysis, it is time to get my hand dirty by doing static analysis.

Static Analysis

Doing static analysis is tedious and very time consuming thus automation can really help, to speed up everything I dump all the samples into MobSF. Click here you want to check it out. I really recommend it.

Before this I usually reverse the application using Dex2Jar and JD-GUI, but since I found MobSF, it's much easier and faster, with all the information it extract from the APKs I dump, argh! Heaven. Imagine if I have more than 50 sample of malware at one time, how much time I have to spend for each of the malware sample to reverse engineer it. The only things I need is a way to know when the app is compiled. Does anyone know?

Extract Indicator of Compromise (IOC) from the automated tool I still have to do it manually and I should write some script maybe to make this easier and bearable. This is what I need and take at first:

• Package name.
• Version code and version number.
• Manifest file.
• Hash (MD5, SHA1, SHA256).
• Domain & IP Address.
• Version & signing certificate.

After all this is done, reversing the code is the easy part, the hardest part is reading the code,  I go through line by line, method by method, class by class, which part do this and that, referring to the result I gather during dynamic analysis to understand the flow of the code.

Comment and extract snippet of code that really matter and comments the snippet to get the picture of the functionality coded by malware authors. I'll save it in new text file and comment its functionality and use it as part of the report. 

What if that application is obfuscated? That topic I will share later.

Profiling

In this part, I'll use all the information collected from previous activities and start to do further investigation.

I started with domain and IP addresses that were collected previously, using WHOIS and some special tools and gathering more information regarding:

• Domain owner.
• Domain registrant.
• Registrant name.
• Registrant email.
• Domain registrar.
• Public hosting used.
• Domain created and expired.
• Any relevant information.

Why is this information is relevant to your investigation? Because you can construct the timeline of that threat actor campaign, which malware belong to which campaign and providing critical information for escalation process later.

Then I search any detection on signature from hash that I collected in VirusTotal (Usually) for additional information. Nothing fancy, just to check for detection. lol

With all IP addresses and Domain found, I step up my game by gathering more information on that server.

Reporting

I compile the report, make it multiple section. The first section is a general overview of the malware or/and the campaign, facts, figures and statistics. Second part is more in-depth technical report, which probably most management level and non-technical person not even interested. Last part, is where I share and include all the IOCs.

At the same time, I escalate and report to the respective party for take down whether to ISP, domain or public hosting provider and authorities.

That's all.