Triage of suspicious Android apps
From the defence team's side you assess a suspicious APK without running it: you extract permissions, components, tell-tale signs of known families and network indicators, and write a verdict and response note.
Level 301 · 22 lessons · 18 practice labs
Lessons
The first look
- The goals of triage and the rules for working safely
- Hashes, signer and reputation checks
- Red flags: accessibility, SMS, device admin, overlay
- Recognising packer and compiler traces with apkid
- Short task: sort five APKs into clean, suspicious and malicious in ten minutes
Reading behaviour from the code
- Call graphs and API use with androguard
- Familiar patterns of banking trojans: overlays and SMS reading
- Patterns of spyware and stalkerware
- Dropper signs: second stages and dynamic code loading
- Statically extracting configuration and command server addresses
- Short task: summarise in five points what a sample does, from its code
Indicators and detection
- Extracting indicators: domains, IPs, package names, certificate digests
- Writing YARA rules for APKs
- Reading a prepared sandbox report and traffic capture
- Mapping behaviour to ATT&CK Mobile techniques
- Short task: write a YARA rule that catches a sample family and spares clean apps
Verdict and response
- Hunting across the fleet with indicators: which devices have it
- Containment steps: removal, account reset, device quarantine
- Writing the triage report
- What to tell staff after an incident: clear, blame-free language
- Short task: find the affected devices in an MDM export with an indicator list
Capstone
- Capstone: examine a fake parcel app sent to staff by SMS and write the response note
Practice labs
- Extract an APK's hash and signer: Record the sample's SHA-256 hash and signing certificate details.
- Draw red flags from the permission combination: Show the accessibility, SMS and overlay combination in a sample's permissions and components and say what it means.
- Sort five APKs into clean, suspicious and malicious: Write a reasoned verdict for each sample based on hash, signer, permissions and packer traces.
- List which sensitive APIs a sample calls: Use androguard to extract its use of SMS, contacts and location APIs.
- Show overlay behaviour from the code: In the inert training sample, find the target app list and the class that opens the overlay window.
- Summarise a sample's behaviour in five points: Summarise persistence, data collection, communication and concealment behaviour with code evidence.
- Extract the domains and IPs in a sample: List the network indicators from code and resources.
- Decode the server address from a config file: Decode the encoded configuration in assets and add the command address to the indicator list.
- Combine a sandbox report with static findings: Merge the indicators in the prepared report and traffic capture with the static ones into a deduplicated list.
- Run a ready-made YARA rule on a sample set: List which files the rule matches.
- Write a YARA rule for a sample family: Find the strings common to three inert samples and write the rule that catches them all.
- Test the rule against clean apps and tighten it: Run the rule over twenty clean APKs, remove the false match and deliver the final version with notes.
- Map behaviours to ATT&CK Mobile techniques: Match five given behaviours to their technique IDs.
- Write a one-page triage report: Prepare the report with verdict, evidence, indicators and recommended steps.
- Write the response note for a fake parcel app: Examine the inert sample sent by SMS to Kuzeyyıldızı Kargo staff and deliver the verdict, indicators, containment and staff notice text.
- Search the fleet by package name: Find the devices in the MDM export that have the given package installed.
- Find renamed copies by certificate digest: Extract from the export the apps installed under different package names but the same signer.
- Write a containment plan for the affected devices: List the devices matching the indicators, order them by priority and plan removal, account reset and quarantine steps.
About this course
From the defence team's side you assess a suspicious APK without running it: you extract permissions, components, tell-tale signs of known families and network indicators, and write a verdict and response note.
What you will learn
- The first look
- Reading behaviour from the code
- Indicators and detection
- Verdict and response
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.