Quark Engine v24.1.1 releases: automating analysis of suspicious Android application
Quark Engine
An Obfuscation-Neglect Android Malware Scoring System
Android malware analysis engine is not a new story. Every antivirus company has its own secrets to build it. With curiosity, we develop a malware scoring system from the perspective of Taiwan Criminal Law in an easy but solid way.
We have an order theory of criminal which explains stages of committing a crime. For example, the crime of murder consists of five stages, they are determined, conspiracy, preparation, start and practice. The latter the stage the more we’re sure that the crime is practiced.
According to the above principle, we developed our order theory of android malware. We develop five stages to see if malicious activity is being practiced. They are 1. Permission requested. 2. Native API call. 3. A certain combination of native API. 4. Calling sequence of native API. 5. APIs that handle the same register. We not only define malicious activities and their stages but also develop weights and thresholds for calculating the threat level of malware.
Malware evolved with new techniques to gain difficulties for reverse engineering. Obfuscation is one of the most commonly used techniques. In this talk, we present a Dalvik bytecode loader with the order theory of android malware to neglect certain cases of obfuscation.
Our Dalvik bytecode loader consists of functionalities such as 1. Finding cross-reference and calling sequence of the native API. 2. Tracing the bytecode register. The combination of these functionalities (yes, the order theory) not only can neglect obfuscation but also match perfectly to the design of our malware scoring system.
Detail Report
This is how we examine a real android malware (candy corn) with one single rule (crime).
$ quark -a sample/14d9f1a92dd984d6040cc41ed06e273e.apk \
-r rules/ \
--detail
Summary Report
Examine with rules.
quark -a sample/14d9f1a92dd984d6040cc41ed06e273e.apk \
-r rules/ \
--easy
Changelog v24.1.1
New Documents
- Add a detailed explanation for the method get_rule_classification_data. Check here for the details. (#596)
- Introduce the Quark Core Library team and the Quark Script team. Check here for the details. (#601, #605)
Bug Fix
- Fix permission analysis in the radare2 core for APKs with UTF-8 encoding. (#602)
Installation
$ git clone https://github.com/quark-engine/quark-engine.git; cd quark-engine/quark
$ pipenv install
$ pipenv shell
$ python setup.py install
Make sure your python version is 3.7, or you could change it from Pipfile to what you have.
Usage
$ quark --help
usage: quark [-h] [-e] [-d] -a APK -r RULE
optional arguments:
-h, --help show this help message and exit
-e, --easy show easy report
-d, --detail show detail report
-a APK, --apk APK APK file
-r RULE, --rule RULE Rules need to be checked
Tutorial
Copyright (C) 2019
