Quark Android Malware Family Analysis Reports

MITRE definition (T1582): Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects. This can be accomplished by requesting the RECEIVE_SMS or SEND_SMS permissions depending on what the malware is attempting to do.

https://i.ibb.co/ZpvV0M9d/t1582-sms-control.png

onReceive calls SMRC to monitor incoming SMS messages and extract sender phone numbers and message content. Together, these calls enable the receiver to intercept and inspect SMS data as it arrives on the device.

Behaviors detected by Quark:

Monitor the general action to be performed (#00025)
Query the phone number from SMS sender (#00049)
Check if the content of SMS contains given string (#00118)
Monitor incoming SMS message (#00234)

4. T1616 Call Control

T1624 Event Triggered Execution — attack.mitre.org

MITRE definition (T1616): Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

https://i.ibb.co/dwXRxbFg/t1616-call-control.png

onCreate constructs an implicit intent with a phone number and initiates a phone call via setData. Combined, these APIs enable the activity to programmatically place outbound calls without user interaction.

Behaviors detected by Quark:

Implicit intent(view a web page, make a phone call, etc.) via setData (#00051)
Make a phone call (#00202)
Put a phone number into an intent (#00203)

5. T1624 Event Triggered Execution

MITRE definition (T1624): Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.

https://i.ibb.co/5hcSxDhz/t1624-event-triggered-execution.png

The behavior map above shows GodFather subscribing to the incoming-SMS broadcast — Android’s SMS_RECEIVED is one of the canonical “specific events” called out in the MITRE definition, and the malware uses it as a trigger for persistent execution. onReceive monitors the general action performed and incoming SMS messages, enabling the receiver to detect and respond to SMS arrival events in real time.

Behaviors detected by Quark:

Monitor the general action to be performed (#00025)
Monitor incoming SMS message (#00234)

6. T1629 Impair Defenses

T1629 Impair Defenses — attack.mitre.org

MITRE definition (T1629): Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

https://i.ibb.co/mCQTFWZb/t1629-impair-defenses.png

The behavior map above shows GodFather deleting SMS and call-log entries via content URIs — a concrete instance of impairing the user’s ability to audit communication activity (matching the MITRE definition’s phrase “detection capabilities defenders can use to audit activity”). DelSent deletes media specified by content URIs, including SMS and call logs, erasing traces of communication activity.

Behaviors detected by Quark:

Deletes media specified by a content URI(SMS, CALL_LOG, File, etc.) (#00052)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	0B72C22517FDEFD4CF0466D8D4C634CA73B7667D378BE688EFE131AF4AC3AED8
2	138551CD967622832F8A816EA1697A5D08EE66C379D32D8A6BD7FCA9FDEAECC4
3	20116083565A50F6B2DB59011E9994E9A9F5DB5994703D53233B8B202A5AD2F3
4	3BBEF6F36E2E673DF2620A01463F9B598D0F70C76F450601EC29873D8EBA5B7A
5	3D4F63FC88EC8A4DFC9A5C3FEE1A59DED40BBB2F4F04ED937C135B144E8A166D
6	58D335B2FD86126AB18CFBECD117C7700D154A2473CC1BDD507C0F57FA7052E3
7	6E0D01C4C547D235C247A6D0719F2ACA2D4996AE78DF4B671275914A9E3FD2D3
8	75CC07A1AF57D9D2A9A06840A25D1B9B368B1DDD57D98BAC9A5A5F2F4D0D931D
9	9DFB5B4AD9AAC36C2D7FBB93F8668FAA819CB0DF16F4A55D00F1CDDA89C9A6D2
10	A14AAD1265EB307FBE71A3A5F6E688408CE153FF19838B3C5229F26EE3ECE5DD
11	A6ED100AE42E4FDABFD1B4C992762152BC4A11CC8E521B647B444C75BB7A9782
12	C2BCCFC8B3BDF2DA5FB5C22055A9C4859256BE7904933E9E0B92FA31FD0420D3

TangleBot Malware Family Analysis Report

New Quark rule (#00275) is now available. This rule targets TangleBot. Check here for the rule details.

With these rules, Quark is now able to identify the TangleBot malware family as high-risk. In our experiment, Quark achieved 100% accuracy and 100% precision. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy. The table below lists every technique documented for TangleBot (per software entry S1069 TangleBot) alongside how each manifests in real-world campaigns — all of which the current Quark rule set can detect statically from APK bytecode.

MITRE Technique	Real-world manifestation
T1430 Location Tracking	Real-time GPS coordinate harvesting to monitor victim physical movements and location
T1418 Software Discovery	Enumerating installed applications to profile device usage and identify high-value targets
T1513 Screen Capture	Capturing screenshots to exfiltrate sensitive on-screen data including credentials and messages
T1582 SMS Control	Intercepting and exfiltrating SMS messages including authentication codes and private communications
T1616 Call Control	Initiating, redirecting, or blocking phone calls to facilitate fraud or eavesdropping

All behavior maps below were rendered from sample 7badeb43e25c4bc7772b4e62d97a7bffc84a02b8f50ea83e8ab8acb598a20bad.apk — chosen as the representative sample whose detected behaviors most fully cover the documented profile of TangleBot. The other 8 family samples were used to compute the accuracy and precision figures above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1430 Location Tracking

T1430 Location Tracking — attack.mitre.org

MITRE definition (T1430): Adversaries may track a device’s physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device. On Android, applications holding the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions provide access to the device’s physical location.

https://i.ibb.co/TM3Pq43V/t1430-location-tracking.png

Ld/g$g;c retrieves device time, longitude, current location, and last known location through location services. Together, these calls enable precise geographic tracking of the device over time.

Behaviors detected by Quark:

Get location of the device (#00075)
Get last known location of the device (#00115)
Get device time and longitude (#00214)

2. T1418 Software Discovery

T1418 Software Discovery — attack.mitre.org

MITRE definition (T1418): Adversaries may attempt to get a listing of applications that are installed on a device.

https://i.ibb.co/WWz6wcTf/t1418-software-discovery.png

Lc0/d;a queries package information for a specific application installed on the device. This call enables the malware to enumerate installed app details including version and permissions.

Behaviors detected by Quark:

Get the package info of a particular app (#00231)

3. T1513 Screen Capture

T1513 Screen Capture — attack.mitre.org

MITRE definition (T1513): Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information.

https://i.ibb.co/S79Ntp63/t1513-screen-capture.png

Ll3/c$a;onSuccess extracts screenshot data into bitmap format and compresses the resulting image. Together, these calls capture the device screen and reduce the image’s file size so it can be exfiltrated efficiently.

Behaviors detected by Quark:

Extract screenshot data to bitmap format (#00238)
Compress bitmap (#00269)

4. T1582 SMS Control

MITRE definition (T1582): Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects. This can be accomplished by requesting the RECEIVE_SMS or SEND_SMS permissions depending on what the malware is attempting to do.

https://i.ibb.co/dJM0jdST/t1582-sms-control.png

Ll3/a;t calls two helpers to query and read SMS and call log data from URIs, then sends SMS messages. Together, these calls enable both exfiltration of existing messages and transmission of new SMS content.

Behaviors detected by Quark:

Read sensitive data(SMS, CALLLOG) and put it into JSON object (#00010)
Query data from URI (SMS, CALLLOGS) (#00011)
Send SMS (#00040)
Read sensitive data(SMS, CALLLOG, etc) (#00077)
Query a URI and append the result into a string (#00190)

5. T1616 Call Control

T1418.001 Security Software Discovery — attack.mitre.org

MITRE definition (T1616): Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

https://i.ibb.co/HDwSFHYk/t1616-call-control.png

Ll3/a;C constructs an implicit intent with a phone number and initiates a phone call via setData. Combined, these APIs enable programmatic dialing to arbitrary numbers without user interaction.

Behaviors detected by Quark:

Implicit intent(view a web page, make a phone call, etc.) via setData (#00051)
Make a phone call (#00202)
Put a phone number into an intent (#00203)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	1F8AA27D59C8B9C5D1F28610C1F195C7C6EFA2C80F98842FD3FB18B4241472C3
2	6098A436094F1E3E8721FB87FF36781A1A283711CC0388F608723A18132607C4
3	669C3BE3CB02D6A20F74EB13104E145747C8E3D4E7A51103F95F3F97EBA958CE
4	752AC24697F9581E90655BC03FDE742EA70ABA5EE831AC8BBEE113DF3B1CAB6E
5	7BADEB43E25C4BC7772B4E62D97A7BFFC84A02B8F50EA83E8AB8ACB598A20BAD
6	A72E0D19CB6DB3D96D27F97874C4462589AE0242EAE024D924D08B0663EB5019
7	BE512E871FC1871314794EA0E83F70EBE6CD9E537883ACA6CA41440B3032DBFC
8	BF781F7D66A8CED4929674EA81A87C814F617EF677301B5EE4B4D32C04287B68
9	D5D9B9FD3A6C5A9F44CE9EE46A32822F3E9261F4DF68466FAE809D58FA58A1D7

BRATA Malware Family Analysis Report

Quark’s existing rule set already detects the BRATA malware family — no new rule was required. Check here for the rule set.

With these rules, Quark is able to identify the BRATA malware family as high-risk. In our experiment, Quark achieved 100% accuracy and 100% precision. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy. The table below lists every technique documented for BRATA (per software entry S1094 BRATA) alongside how each manifests in real-world campaigns — all of which the current Quark rule set can detect statically from APK bytecode.

MITRE Technique	Real-world manifestation
T1418.001 Security Software Discovery	Detecting antivirus or security products to evade analysis and detection
T1513 Screen Capture	Recording device screen content to harvest credentials and sensitive user data
T1533 Data from Local System	Exfiltrating contacts, messages, photos, and other locally stored personal information

All behavior maps below were rendered from sample 2d15bc6c736c5422f3673d94c8f9d3d28ac1512eae6f459cd768842103266937.apk — chosen as the representative sample whose detected behaviors most fully cover the documented profile of BRATA. The other 21 family samples were used to compute the accuracy and precision figures above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1418.001 Security Software Discovery

MITRE definition (T1418.001): Adversaries may attempt to get a listing of security applications and configurations that are installed on a device. This may include things such as mobile security products.

https://i.ibb.co/93zRnd2y/t1418-001-security-software-discovery.png

The behavior map above shows BRATA querying the package manager for a single application’s information and display label (GetApplicationLabel). Malware uses this same lookup to check for security software: by querying the package names of known antivirus or mobile-security apps, it can tell whether any are installed. This is the Security Software Discovery (T1418.001) behavior documented for BRATA — it lets the malware decide whether to keep operating or stay dormant to avoid detection.

Behaviors detected by Quark:

Get application info and label (#00265)

2. T1513 Screen Capture

T1513 Screen Capture — attack.mitre.org

MITRE definition (T1513): Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information.

https://i.ibb.co/Vc5vwfSG/t1513-screen-capture.png

onImageAvailable copies pixels from the latest rendered image into a Bitmap object. This call enables the malware to capture screenshots of the device screen in real time.

Behaviors detected by Quark:

Copy pixels from the latest rendered image into a Bitmap (#00210)

3. T1533 Data from Local System

T1533 Data from Local System — attack.mitre.org

MITRE definition (T1533): Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges.

https://i.ibb.co/WSWys6t/t1533-data-from-local-system.png

FindByMail calls getAllContacts to read records from a content provider via ContentResolver, iterating the returned cursor. Both are methods of the app’s B4A ContactsWrapper, indicating the queries target the device’s contact database. The behavior map evidences these generic content-provider reads; it does not pin down a specific field such as email address.

Behaviors detected by Quark:

Query a URI and check the result (#00187)
Query device data with ContentResolver (#00212)
Query device data with ContentResolver and obtain the number of results (#00215)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	27E0EC79DBB7C7F99B43C8C01A94188D1071D1245B1745D0E066AE774C78A8F8
2	2846C9DDA06A052049D89B1586CFF21F44D1D28F153A2FF4726051AC27CA3BA7
3	2D15BC6C736C5422F3673D94C8F9D3D28AC1512EAE6F459CD768842103266937
4	32552C098CD0E8075583162B1E895F1089A3E97FA9AC6281C0D0272D9AF132E2
5	37A0F317B897F23F5A6BA4A6B1C5E03A80333FF81BC8C1FADC09EB4C1914797D
6	4392358E24121C8C9C1BD36341286CEAD074ECE01B5E615EC56C572F5583E0B0
7	46F4F981BE30D60795164F97B45219C523DBF8F59608901EB29DA42BCF941CFE
8	4C57C5EAE5A1BAE1A50BEED28AFFDFF722C89416886E5EDA8088A06771CC29C8
9	5395936963DF4D72B365FD30AB52A00A88F8A5F75336BA84AC8A9FC369E0F811
10	6327B82AAAB714DC17322E1F215BCA9219F937A1DF6F71C8892BF75FCFA53830
11	80443FF27C7D665E1D9DB78CE70E67478C2A2F47DB4F84AF7BA4DB85C0EAD677
12	98B778F619E1C0F822B9514C81B9869F0302A2FEF53754739BB92C67D02609E0
13	9BF89B33609973D48C7D09D5774C39BFCEFD3922202DB0D872F12B3FFDB28529
14	B2EC5CBCA08D8AEF4F638FFB479FDF613EEAA31FF9C30C73DBEDA7FF8EB4A25B
15	B5A64791728AA641838D2A478375F5D46F91C91B8DF0CDE34B21DDA2D4D7D8A1
16	B64123E4FF92CD7BE104B21CA0DEAEFD89E8270572746C61EFC3E7CD05999B5D
17	D774779A1E53D5C1012EC855CD6567D6E9F779299DDF0D07E96DDE6C0679F4DF
18	D7AF3C8E53B2B1B5B84E5542353FC80C28B2297238469E189F7C83ACB666943B
19	DCDCACAFACB1F8A9474FF714DD418E0104E854B87AD07220CE5E4564568CE997
20	ED1C4B8B6F7ED4F93A9B06F4FBE4BB28782994BC121CD0540F9DE62FF22FA78F
21	F690E30B6EE25C153EFFC5620FD7EC61481A449A127B54A67C7AFC4C13D7917F
22	FA816C631249922539EEEB3E8F73D3EF4EA997AB729751ADEBCEA3D0DE32A63B

Cerberus Malware Family Analysis Report

This report analyses Cerberus malware family using Quark’s rule classification. A new rule (#00276) was generated from this family’s samples and added to Quark’s rule pool, but is not directly demonstrated below. Check here for the rule details.

Quark’s rule classification flagged 10 of 10 Cerberus samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

The behaviours below are referenced from MITRE ATT&CK® Mobile — S0480 Cerberus.

This report analyzes the Cerberus malware family through the lens of the MITRE ATT&CK Mobile framework, corresponding to the S0480 Cerberus software entry. Each section below examines one documented technique employed by this banking trojan. The table below summarizes how each technique manifests in observed Cerberus campaigns.

MITRE Technique	Real-world manifestation
T1406 Obfuscated Files or Information	String encryption and code obfuscation to evade static analysis detection
T1516 Input Injection	Automated interaction with device interfaces to enable permissions or execute transactions
T1628.001 Suppress Application Icon	Hiding the malicious app icon from launcher to reduce user visibility

All behavior maps below were rendered from sample 0706aff99ddb41d810d081490cb6b2b70d9ee0092a642716d7ce28011ce616a5.apk — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Cerberus. The other 9 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1406 Obfuscated Files or Information

T1406 Obfuscated Files or Information — attack.mitre.org

MITRE definition (T1406): Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

https://i.ibb.co/0yNKCsHw/t1406-obfuscated-files-or-information.png

Lcom/gupocufbbxbijsq/gtenurim/b/a;b directly decodes Base64 data and writes the result to a file. This call enables the malware to stage obfuscated content on disk in decoded form.

Behaviors detected by Quark:

Write file after Base64 decoding (#00024)

2. T1516 Input Injection

T1516 Input Injection — attack.mitre.org

MITRE definition (T1516): A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android’s accessibility APIs. [Input Injection](https://attack.mitre.org/techniques/T1516) can be achieved using any of the following methods: * Mimicking user clicks on the screen, for example to steal money…

https://i.ibb.co/SwsTp4dC/t1516-input-injection.png

onAccessibilityEvent calls 2 helpers to retrieve accessibility nodes by view ID and root window access. Together, these calls enable automated interaction with UI elements through the accessibility service.

Behaviors detected by Quark:

Use accessibility service to perform action getting node info by View Id (#00160)
Use accessibility service to perform action getting root in active window (#00167)
Use accessibility service to perform global action getting node info by View Id (#00169)

3. T1628.001 Suppress Application Icon

T1628.001 Suppress Application Icon — attack.mitre.org

MITRE definition (T1628.001): A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application’s icon programmatically does not require any special permissions.

Lcom/gupocufbbxbijsq/gtenurim/b/a;m directly hides the current application’s icon from the launcher. This call enables the malware to conceal its presence from the user’s home screen.

Behaviors detected by Quark:

Hide the current app’s icon (#00079)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	00EC32AE4B2F32C99A8053FB0B7A5DACDFDAD2FA1981F058919CC484B4A5924C
2	0314EA6AD3CF224A9417CCFD1F8A784A836472094C04A6BC2FFB688313131ECB
3	03B8C573CD719E544D027170E25799FFEEB61B3D0BA9827EA0D2248E0A66319D
4	03C67802E809E75A774527C60517A5BA7FFDD496BB5EFBA91E231C45D4A971F8
5	047E3ECDB04D695B7E8A3C2789C29EC57DA19F58BDCDB1D97FA926205CE718EB
6	0706AFF99DDB41D810D081490CB6B2B70D9EE0092A642716D7CE28011CE616A5
7	075352F0F8AC06163F06380FBA36D778046E5C9CE3FFA15EF082F2EA1FEC09EB
8	0AA521F42CB6A9D50C8FEAB780440265A8ECB70D2EE76AAA0B8DBAEB79672911
9	0AF86E1888A23AD365DE7E1D8E5F7A8900D3047321557C6A0F3B2C3822D094B6
10	0B018C290DBB5AA2AF3F324F2A83C6654D5A47E4026413A6A082623BF2E35787

SuperCardX Malware Family Analysis Report

This report analyses the SuperCardX malware family using Quark’s existing rule pool — no new rule was added for this family. SuperCardX is an Android NFC banking trojan that collects sensitive device information including GPS location, ANDROID_ID, phone details, and clipboard contents while employing multiple evasion techniques such as emulator detection, obfuscation, and reflection. It downloads additional modules at runtime, sends SMS messages, and maintains network connectivity through HTTPS connections. The malware requests dangerous permissions and can manipulate files, processes, and WiFi configurations on infected devices. Check here for the rule pool details.

Quark’s rule classification flagged 7 of 7 SuperCardX samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy. The table below lists the techniques observed in SuperCardX samples through Quark’s static bytecode analysis, alongside how each manifests in real-world campaigns.

MITRE Technique	Real-world manifestation
T1406 Obfuscated Files or Information	Reflective method invocation to hide code semantics from static analysis tools
T1407 Download New Code at Runtime	Dynamic class loading to fetch and execute additional payload modules after install

All behavior maps below were rendered from sample 1660b4fe77254fac07aabaf39a11ae3462a6513cc861c8620b56b8734aa46a90.apk — chosen as the representative sample whose detected behaviors most fully cover the documented profile of SuperCardX. The other 6 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1406 Obfuscated Files or Information

T1406 Obfuscated Files or Information — attack.mitre.org

MITRE definition (T1406): Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

https://i.ibb.co/jPcscPL7/uses-reflection.png

LL1/b;f directly finds methods by class name, invokes them dynamically, and performs method reflection. Combined, these APIs enable runtime method discovery and invocation that evades signature-based static analysis.

Behaviors detected by Quark:

Invoke method dynamically via reflection (#00276)

2. T1407 Download New Code at Runtime

T1407 Download New Code at Runtime — attack.mitre.org

MITRE definition (T1407): Adversaries may download additional code or resources at runtime to update existing capabilities or to install new modules at execution time. Adversaries may use this technique to update legitimate-looking malicious code or to gradually escalate capabilities after initial install.

https://i.ibb.co/NcMVWXt/access-the-class-loader-often-done-to-load-a-new-code.png

LX2/i;a directly loads an external class via the class loader. This call enables the malware to dynamically load additional code modules at runtime, expanding capabilities beyond what is visible in the on-disk APK.

Behaviors detected by Quark:

Load external class (#00032)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	1660B4FE77254FAC07AABAF39A11AE3462A6513CC861C8620B56B8734AA46A90
2	16F961B4F3F974109AE0DE2546B092138BD29DCC1B8EC12EFC487D34DDEA2BD4
3	2C6B914F9E27482152F704D3BAEA6C8030DA859C9F5807BE4E615680F93563A0
4	331DE31F0862980F9609B8F6A1DB7585AC23BEA5676BE4DE6B7F74BCF0DADFCF
5	3FB91010B9B7BFC84CD0C1421DF0C8C3017B5ECF26F2E7DADFE611F2A834330C
6	AA264D6F85A121013D96BF0FE81239C328AE49C5965F49A91CA9049B968B2DB8
7	BA622A4F0D30C433A1D36DDFF294759582067D5EAE438937DEF75987FAC67B33

NGate Malware Family Analysis Report

A new Quark rule (#00277) was generated to detect NFC reader-mode preparation and added to Quark’s rule pool. NGate is an Android NFC banking trojan first documented by ESET in 2024, targeting Slovak banking customers. It is documented to weaponize the open-source NFCGate research toolkit to relay contactless payment card data from the victim’s phone to an attacker-controlled device, enabling unauthorized point-of-sale and ATM transactions. Check here for the rule pool details.

Quark’s rule classification flagged 14 of 14 NGate samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy. NGate has no dedicated MITRE software entry. The techniques below were observed in NGate samples through Quark’s static bytecode analysis.

MITRE Technique	Real-world manifestation in NGate
T1644 Out of Band Data	Configuring the IsoDep NFC reader with a non-default transceive timeout — the canonical preparation step required before APDU exchange over the NFC out-of-band channel, used by NGate as part of its documented contactless-card relay chain
T1406 Obfuscated Files or Information	Dynamic method invocation via Java reflection from many attacker-authored classes, hiding the malware’s true control flow from static analysis tools
T1628.001 Suppress Application Icon	Programmatically hiding the malicious app’s launcher icon after installation to delay user detection and removal

All cluster representatives below were extracted from sample 98f2667aec5f74c0701467ea86c6a45a53604075f968263c12650759d157ba59.apk — chosen as the representative sample whose detected behaviors most fully cover the documented profile of NGate. The other 13 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1644 Out of Band Data

T1644 Out of Band Data — attack.mitre.org

MITRE definition (T1644): Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks. Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth.

LK1/d;b (a ProGuard-renamed class operating on Landroid/nfc/Tag, consistent with the NFCGate-derived reader-mode initialization that NGate is documented to repackage) calls IsoDep.get(Tag) to acquire an IsoDep handle for the contactless card and then IsoDep.setTimeout(int) on the same instance, with the IsoDep reference flowing directly between the two calls. Configuring a custom transceive timeout is uncharacteristic of legitimate payment apps (which use the platform default) and is the canonical setup step required before any subsequent APDU exchange over the NFC out-of-band channel.

Behaviors detected by Quark:

Configure custom timeout for IsoDep card communication (NFC reader-mode preparation) (#00277)

2. T1406 Obfuscated Files or Information

T1406 Obfuscated Files or Information — attack.mitre.org

MITRE definition (T1406): Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

LO/q;onPrepareActionMode is one of nine distinct attacker-namespace parents in this sample where the malware dynamically resolves a method by name and invokes it via reflection. Spreading reflective dispatch across many short ProGuard-renamed classes obfuscates the actual call targets from static disassembly tools that match on direct call edges, falling under T1406’s broader “otherwise obfuscating its contents” clause for control-flow obfuscation.

Behaviors detected by Quark:

Invoke method dynamically via reflection (#00276)

3. T1628.001 Suppress Application Icon

T1628.001 Suppress Application Icon — attack.mitre.org

MITRE definition (T1628.001): A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application’s icon programmatically does not require any special permissions.

LZ/h;run (an attacker-authored Runnable executed from background context) toggles the launcher activity’s ComponentEnabledSetting to COMPONENT_ENABLED_STATE_DISABLED, hiding the app’s icon from the device home screen. This delays user discovery of the installed app and makes uninstalling it harder.

Behaviors detected by Quark:

Hide the current app’s icon (#00079)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	0E2AEE7B6CF50249520F0F824EA52F7770E2D2A791F0E6D94C514B11ED482FA4
2	162F8C6BAFE0C343C37F173344C4F6880EAEC0AEA7B491565DB874366B161784
3	17A16F08108E25AF1C8B058ADBACA2CADA6A93C2D38C9854148F9E9CAAC76AC3
4	1D126E5904DDE3B46175A4AAE89EEC1FB8A6B80E35B1F473878E5DD288F8AAE6
5	31FDAA61CADD545C4C859ED255ADA413CBB09B2201F047745A7374EC1D54AA43
6	3CB4B373A24AFB10B8003762E763E6B44008BDF9A58D0A9A2B80A5DE68308ECD
7	45BBA7681E5A2C3512E6337BAED739D3AF30AF5BFC9FFE0AE18E211E068274A1
8	54EAC45F3F5AC121C74C2EF66923CD3DA5A5DC8B03BF3E4C43935FCC1E5F6EED
9	5CFE6EC669BE05D457D9B98CDD76901CC8913AE9F4E8B1A29D97770C6925A5C4
10	9220B2F18DD79BEF1D9B3739D42DA538BFBCC73CDA4F9B0028C2F425BE501FB1
11	95D906DCA5A3BE5CF066268662B3C953860E54E9CDCFCD427FAF0AAA9CB62BAD
12	98F2667AEC5F74C0701467EA86C6A45A53604075F968263C12650759D157BA59
13	C659454DD6ED62BC7A0C9E0455297E41BA57B0B7935A826150C1F8C0DB6F89D2
14	E19A7C8E4994EA4ED680136C9E3A6FFF7B82C72F5743952821A446B6CB830F06

AhRat Malware Family Analysis Report

This report analyzes the AhRat malware family using Quark’s rule classification. AhRat is an Android remote access trojan (RAT) derived from the open-source AhMyth project. It was publicly disclosed by ESET in May 2023 inside the “iRecorder — Screen Recorder” application on Google Play (~50,000 installs at the time of takedown), and continues to circulate as repackaged flashlight, screen-recorder, and utility apps in third-party Android stores. This run did not generate a new rule for AhRat: the family’s most distinctive bytecode patterns (microphone audio capture, camera photo capture, SMS reads AND sends, last-known-location lookups) are already covered by Quark’s existing rule set. Check here for the rule set details.

Quark’s rule classification flagged 15 of 15 AhRat samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S1095 AhRat software entry. Of the 15 techniques documented for the family, Quark’s static bytecode analysis surfaces the 5 listed below; the other 10 rely on runtime or network observation, or are not exercised by the samples in this cohort.

MITRE Technique	Real-world manifestation in AhRat
T1429 Audio Capture	Recording microphone audio via `MediaRecorder` from an attacker-authored `MicManager` helper for on-device surveillance
T1430 Location Tracking	Reading the device’s last-known GPS coordinates via `LocationManager.getLastKnownLocation` for later collection by the RAT dispatcher
T1513 Screen Capture	Decoding a raw JPEG byte buffer into a `Bitmap` and recompressing it back to a JPEG payload for the RAT dispatcher to ship out
T1533 Data from Local System	Querying the SMS and call-log content providers with `ContentResolver` and copying the message body / address / metadata into a JSON object
T1582 SMS Control	Dispatching operator-driven SMS actions from a C2 socket — the `SocketManager` receiver routes commands to helpers that both read the inbox and issue outbound `SmsManager.sendTextMessage` sends

All cluster representatives below were extracted from sample c90bb703a45863aa5e7fdc60a4ad32f933adca82ecddb1c42cf35a17f8078434.apk — chosen as the representative sample whose detected behaviors most fully cover the documented profile of AhRat. The other 14 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1430 Location Tracking — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

Lcom/lahsuak/apps/flashlight/connect/MicManager;startRecording (an attacker-authored helper class bundled inside a repackaged “flashlight” carrier app) initializes a MediaRecorder with the microphone as its audio source and starts recording ambient audio to a file. The captured audio is then read back by the RAT dispatcher for delivery to the operator.

Behaviors detected by Quark:

Initialize the recorder and start recording (#00198)

2. T1430 Location Tracking

MITRE definition (T1430): Adversaries may track a device’s physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device. On Android, applications holding the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions provide access to the device’s physical location.

Lcom/lahsuak/apps/flashlight/connect/LocManager;getLocation (an attacker-authored helper class bundled inside a repackaged “flashlight” carrier app) calls LocationManager.getLastKnownLocation and then reads the latitude/longitude off the returned Location instance. The call sequence returns the device’s last-known GPS coordinates to the RAT dispatcher, matching the location-collection surface T1430 describes.

Behaviors detected by Quark:

Get last known location of the device (#00115)

3. T1513 Screen Capture

T1513 Screen Capture — attack.mitre.org

MITRE definition (T1513): Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information.

Lcom/lahsuak/apps/flashlight/connect/CameraManager;sendPhoto (an attacker-authored helper class bundled inside a repackaged “flashlight” carrier app) decodes a raw JPEG-byte buffer into an in-memory Bitmap and then compresses that bitmap back out to a JPEG stream for exfiltration by the RAT dispatcher. This decode-then-recompress pattern is how AhRat’s photo-collection helper packages a fresh camera frame into a network-ready payload before shipping it to the operator.

Behaviors detected by Quark:

Initialize bitmap object and compress data (e.g. JPEG) into bitmap object (#00001)
Compress bitmap (#00269)

4. T1533 Data from Local System

T1533 Data from Local System — attack.mitre.org

MITRE definition (T1533): Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges.

Lcom/lahsuak/apps/flashlight/connect/SMSManager;getSMSList opens a ContentResolver cursor against the SMS and call-log content URIs, iterates the result set, and copies message body / address / call metadata fields into a JSON object. This is the local-database read step that satisfies the “search local system sources … to find files of interest and sensitive data” clause of T1533; the returned JSON object is the collected artefact.

Behaviors detected by Quark:

Query data from URI (SMS, CALLLOGS) (#00011)
Read sensitive data(SMS, CALLLOG, etc) (#00077)
Get messages in the SMS inbox (#00191)
Query device data with ContentResolver (#00212)
Query device data with ContentResolver and a URI parsed from a string (#00222)

5. T1582 SMS Control

MITRE definition (T1582): Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware via SMS, or various external effects.

Lcom/lahsuak/apps/flashlight/connect/SocketManager;x0000sm is the C2 message dispatcher: it receives operator commands over the socket and routes each command to a dedicated helper. Two of those helpers — SMSManager;sendSMS and SMSManager;getSMSList — wrap the platform SmsManager.sendTextMessage and the SMS-inbox ContentResolver query respectively. Together they let the remote operator both inject outbound SMS and pull inbox content on demand.

Behaviors detected by Quark:

Check if successfully sending out SMS (#00008)
Send a SMS message (#00193)
Query data from URI (SMS, CALLLOGS) (#00011)
Read sensitive data(SMS, CALLLOG, etc) (#00077)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	057689E28C35811575811BEAA1FA07BDC0130188F4590D286A564A0236060048
2	0C258DE0590AEFC9B66BE08A33015581373E19FE9887355C57D9FEF59153906A
3	0C485D9CBF8AAE82788B863512C750EA0B01A859AC4C7AE2461ED52482C02FED
4	1D000EF8D964BA22ACF820DEBD2C24222FF34353C145D69E4266EB2CC7588BA3
5	1E1E23C920EEACA8E9FFC1F946FCB978FA2419815B7B5DCF9A1CCA9B934F8C4B
6	2AEC43A86C635CAE0EC5F4BD2E216EBA61DA36B65068A86DA324224627193BCE
7	4D814FDFB79B50F4DA1CDCC3ACA7FBCC4C9C1826CDBDCCE86CFD72906DBE8F8F
8	4D89AFB5E33AE85630D73D0B3D9765F523B9E0B6E1E80E4CE50780EA486B8315
9	6DE9C4A91A1D17473029AA0C7CA98580779734282CB91BF7AA7B8DD54CD6C6B6
10	8542C3F7C5AC22933F95529085B73F98F6AE7F1548E9AC1B57A7CF9458500A1D
11	A156A76D2041D01594D791DA97E8EB9179841FE0DFC3C6831F8F413CACC0A3DE
12	BCE898587F683C70EA12B8612DD9DC1F791FA748E7C1F4584F4AFB2009A1E135
13	BFC577EA1B9B326609D857E0C7EA4C7DB5C382F86B3FAEB92E9230DA650B3AF9
14	C90BB703A45863AA5E7FDC60A4AD32F933ADCA82ECDDB1C42CF35A17F8078434
15	CDD0D2E6639BFB11299B168748C77BCED8821075C6CB04ED4B1F888A369228FD

AndroRAT Malware Family Analysis Report

This report analyzes the AndroRAT malware family using Quark’s rule classification. AndroRAT is one of the earliest open-source Android remote access trojans, originating from a 2012 university project (DesignativeDave/AndroRAT). Its source code has been extensively forked and repackaged over the years — including the DroidJack commercial fork, the karma9874 revival, and various trojanized carrier apps in third-party stores. A new Quark rule (#00278) was generated to detect the video-capture pattern used by the DroidJack fork (MediaRecorder.setVideoSource + setProfile); other distinctive bytecode patterns (microphone audio capture, last-known-location lookups, SMS send + inbox reads, phone-call intents, call-log reads via ContentResolver) are already covered by Quark’s existing rule set. Check here for the rule set details.

Quark’s rule classification flagged 5 of 5 AndroRAT samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0292 AndroRAT software entry. Of the 10 techniques documented for the family, Quark’s static bytecode analysis surfaces the 7 listed below; see the coverage-gap notes at the end of this section for why the other 3 are not demonstrated here.

MITRE Technique	Real-world manifestation in AndroRAT
T1429 Audio Capture	Recording ambient microphone audio via `MediaRecorder` from a background service for on-device surveillance
T1430 Location Tracking	Reading the device’s last-known GPS coordinates via `LocationManager.getLastKnownLocation` for later collection by the RAT dispatcher
T1582 SMS Control	Receiving operator commands over the C2 socket and issuing outbound `SmsManager.sendTextMessage` sends from the command dispatcher
T1616 Call Control	Constructing an `Intent.ACTION_CALL` intent with an operator-supplied phone number and invoking `startActivity` to place the call
T1512 Video Capture	Configuring a `MediaRecorder` video source and camcorder profile inside a helper class that records video for exfiltration
T1636.002 Call Log	Querying the call-log `ContentResolver` URI to extract call history for exfiltration
T1636.004 SMS Messages	Reading SMS inbox contents (sender address, message body) via `ContentResolver` for exfiltration

All cluster representatives below were extracted from either sample 48d25786... (net.droidjack.sandrorat — the DroidJack fork) or sample 9c8d02ff... (my.app.client — the pristine AndroRAT builder default) or sample 347f1b01... (com.example.reverseshell2 — a widely-forked open-source variant). Different techniques picked different samples as their strongest evidence source. The remaining samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1430 Location Tracking — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

Lnet/droidjack/sandrorat/VideoCap;a (an attacker-authored capture helper in the DroidJack fork) initializes a MediaRecorder with the microphone as its audio source and starts recording ambient audio to a file. The captured audio is then read back by the RAT dispatcher for delivery to the operator.

Behaviors detected by Quark:

Initialize the recorder and start recording (#00198)

2. T1430 Location Tracking

MITRE definition (T1430): Adversaries may track a device’s physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device. On Android, applications holding the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions provide access to the device’s physical location.

Lnet/droidjack/sandrorat/GPSLocation;e (an attacker-authored location helper in the DroidJack fork) calls LocationManager.getLastKnownLocation and reads the latitude/longitude off the returned Location instance. The call sequence returns the device’s last-known GPS coordinates to the RAT dispatcher.

Behaviors detected by Quark:

Get last known location of the device (#00115)

3. T1582 SMS Control

MITRE definition (T1582): Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware via SMS, or various external effects.

Lmy/app/client/ProcessCommand;process (the C2 command dispatcher in the pristine AndroRAT builder namespace) receives operator commands over the socket and routes each command to a helper. Two of those helpers — the SMS-send branch reaching SmsManager.sendTextMessage and the SMS-read branch reaching SMSLister;listSMS — together let the remote operator both inject outbound SMS and pull inbox content on demand.

Behaviors detected by Quark:

Send a SMS message (#00193)

4. T1616 Call Control

T1512 Video Capture — attack.mitre.org

MITRE definition (T1616): Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

Lnet/droidjack/sandrorat/m;a (an attacker-authored call helper in the DroidJack fork) constructs an Intent with the ACTION_CALL action, packs an operator-supplied phone number into the intent’s URI via setData, and invokes startActivity — placing an outbound phone call without user consent.

Behaviors detected by Quark:

Put a phone number into an intent (#00203)
Make a phone call (#00202)
Implicit intent(view a web page, make a phone call, etc.) via setData (#00051)

5. T1512 Video Capture

MITRE definition (T1512): An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files.

Lnet/droidjack/sandrorat/VideoCap;a (an attacker-authored capture helper in the DroidJack fork) calls MediaRecorder.setVideoSource to select the device camera as the recording input, then MediaRecorder.setProfile to apply a camcorder recording profile in preparation for exfiltrating the captured video to the RAT dispatcher. Rule #00278 was added in this run to cover this pair.

Behaviors detected by Quark:

Configure video source and camcorder profile for video capture recording (#00278)

6. T1636.002 Call Log

T1636.002 Call Log — attack.mitre.org

MITRE definition (T1636.002): Adversaries may utilize standard operating system APIs to gather call log data. On Android, this can be accomplished using the Call Log Content Provider.

Lcom/example/reverseshell2/Payloads/readSMS;readSMSBox (an attacker-authored payload class in the reverseshell2 open-source variant — despite the SMS-suggestive name, the method queries both the SMS and call-log content-provider URIs) opens a ContentResolver cursor against those URIs and copies the returned rows into an exfiltration buffer.

Behaviors detected by Quark:

Query data from URI (SMS, CALLLOGS) (#00011)
Read sensitive data(SMS, CALLLOG, etc) (#00077)

7. T1636.004 SMS Messages

T1636.004 SMS Messages — attack.mitre.org

MITRE definition (T1636.004): Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider.

Lnet/droidjack/sandrorat/bd;b (an attacker-authored SMS reader in the DroidJack fork) opens a ContentResolver cursor against the SMS content URI, iterates the result set, and extracts sender address, inbox row IDs, and message body strings for exfiltration.

Behaviors detected by Quark:

Get messages in the SMS inbox (#00191)
Get the address of a SMS message (#00188)
Get the content of a SMS message (#00189)

Coverage-gap notes

The 3 MITRE techniques documented for AndroRAT that this report does NOT demonstrate:

T1422 System Network Configuration Discovery — the samples do read SIM operator and SIM state, but the reads are single-API calls (TelephonyManager.getSimOperator, getSimState) whose bytecode is indistinguishable from what carrier, dual-SIM, roaming-detector, and MFA apps do for legitimate reasons. Quark’s rule format requires two APIs linked by data flow, so this single-API dual-use surface cannot be expressed as a stand-alone rule without a companion API that isolates the malware use case — a rule of that shape does not currently exist in the pool.
T1636.003 Contact List — reading the contacts content provider is likewise a single-step call (ContentResolver.query(Contacts.CONTENT_URI)) that every messenger, dialer, and address-book app performs. This hits the same Quark architectural limit as T1422: no discriminative two-API pattern is available.
T1655.001 Match Legitimate Name or Location — this is a runtime impersonation technique (app icon / name / package-name similarity to a real app) requiring cross-app comparison at install time; it is out of scope for static bytecode analysis.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	347F1B018F643DE0B9C946C94BD490A7426503869A0828B0A70B4D318FA097D6
2	48D25786B7512761ED561BB50DE4C0BD8A19DF0E5DE2BC40CD9D84DDDF11C16D
3	9C8D02FF190F5929BC6745A541C326B2CD387D3145C759823D24972E65398A99
4	C5AB0ADAEDF391A395387DF33B0BF6854F1CCC9C5DA937915EA86B5EEC6E6103
5	D62705186C488BB26FCCDB1404931223A887004FD6704AC1483E599A15E92792

Sova Malware Family Analysis Report

This report analyses the Sova malware family using Quark’s rule classification. Sova is an Android banking trojan first surfaced in mid-2021, distributed as trojanised carrier apps (fake BurgerKing, cryptocurrency wallets, delivery apps) that abuse Accessibility services to overlay banking / crypto exchange UIs, harvest credentials, intercept SMS one-time passwords, and — in the v5 branch — encrypt on-device files as ransomware. This run did not generate a new rule for Sova: the family’s distinctive bytecode patterns (device-fingerprint queries and outbound-call intents from a single C2-message dispatcher) are already covered by Quark’s existing rule set. Check here for the rule set details.

Quark’s rule classification flagged 14 of 14 Sova samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S1062 S.O.V.A. software entry. Of the 19 techniques documented for the family, Quark’s static bytecode analysis surfaces the 3 listed below; see the coverage-gap notes at the end of this section for why the other 16 are not demonstrated here.

MITRE Technique	Real-world manifestation in Sova
T1426 System Information Discovery	Reading device phone number and IMEI inside the C2 ping-response handler for victim profiling
T1582 SMS Control	Dispatching SMS-send operations from a helper (`ContexStartExtensionsKt.sendSMS`) invoked by the C2 ping-response handler with an operator-supplied phone number and body
T1616 Call Control	Constructing an `Intent.ACTION_CALL` intent with an operator-supplied phone number and invoking `startActivity` from the same C2 ping-response handler

All cluster representatives below were extracted from sample 724a56172f40177da76242ee169ac336b63d5df85889368d1531f593b658606b.apk (a fake BurgerKing carrier — package com.tapston.burgerking), chosen as the representative sample whose detected behaviors most fully cover the documented profile of Sova. The other 13 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1426 System Information Discovery

T1426 System Information Discovery — attack.mitre.org

MITRE definition (T1426): Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture.

Lcom/tapston/burgerking/service/worker/PingTasks;onPingReceived (an attacker-authored C2 ping-response handler inside the fake BurgerKing carrier app) is invoked whenever the operator’s ping message arrives on the dispatcher; within this method the malware calls TelephonyManager.getLine1Number and getDeviceId to read the victim’s phone number and IMEI, then ships them back over the C2 socket as part of the ping ACK payload.

Behaviors detected by Quark:

Query the IMEI number (#00033)
Query the phone number (#00038)

2. T1582 SMS Control

MITRE definition (T1582): Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware via SMS, or various external effects.

The same Lcom/tapston/burgerking/service/worker/PingTasks;onPingReceived handler routes a subset of operator commands to an attacker-authored Kotlin extension helper Lcom/tapston/burgerking/extensions/context/ContexStartExtensionsKt;sendSMS, which wraps SmsManager.sendTextMessage to inject outbound SMS on behalf of the operator. The dispatcher also references a content-URI delete primitive on the SMS/call-log providers to remove traces after sending.

Behaviors detected by Quark:

Send a SMS message (#00193)
Deletes media specified by a content URI (SMS, CALL_LOG, File, etc.) (#00201)

3. T1616 Call Control

T1418 Software Discovery — attack.mitre.org

MITRE definition (T1616): Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

The same Lcom/tapston/burgerking/service/worker/PingTasks;onPingReceived handler also handles the “place-call” operator command: it constructs an Intent with the ACTION_CALL action, packs an operator-supplied phone number into the intent’s URI via setData, and invokes startActivity — placing an outbound phone call without user consent.

Behaviors detected by Quark:

Put a phone number into an intent (#00203)
Make a phone call (#00202)
Implicit intent(view a web page, make a phone call, etc.) via setData (#00051)

Coverage-gap notes

The 16 MITRE techniques documented for Sova that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:

The two APIs share a caller, but it sits deeper than Quark searches (7) — While the techniques below are triggered by Sova’s service dispatcher, the actual APIs are hidden in helper functions more than 3 layers deep. For performance reasons, Quark does not search beyond 3 layers by default. As a result, these techniques are currently not detected by Quark, but we are actively working on addressing this limitation.

Technique	First API	Second API	Nearest shared caller
T1516 Input Injection	`AccessibilityNodeInfo.findAccessibilityNodeInfosByText` (6 Sova call sites)	`AccessibilityNodeInfo.performAction` (12 Sova call sites)	`AppAccessibilityService.onAccessibilityEvent`
T1417.001 Keylogging	`AccessibilityEvent.getEventType`	`AccessibilityEvent.getText`	`AppAccessibilityService.onAccessibilityEvent`
T1417.002 GUI Input Capture	`WindowManager.addView` (`TYPE_APPLICATION_OVERLAY`)	`WebView.loadUrl`	activity / service lifecycle callbacks
T1517 Access Notifications	`StatusBarNotification.getPackageName`	`StatusBarNotification.getNotification`	`NotificationListenerService.onNotificationPosted`
T1628.001 Suppress Application Icon	`Context.getPackageManager`	`PackageManager.setComponentEnabledSetting`	reached only inside bundled libraries (AndroidX WorkManager, Xiaomi push, Taobao SDK)
T1629.001 Prevent Application Removal	`DevicePolicyManager.isAdminActive`	`Intent.putExtra` (device-admin request)	device-admin setup flow
T1630.001 Uninstall Malicious Application	`Intent.<init>` (`ACTION_UNINSTALL_PACKAGE`)	`Context.startActivity`	n/a — the pair is too generic to rule on, since every launcher and settings screen uses it

Runtime / network-only behavior (3) — bytecode analysis cannot capture these because the malicious intent lives in runtime C2 messages, not in distinct API pairs.

T1464 Network Denial of Service — DDoS traffic is issued via generic Socket.connect / HttpURLConnection, indistinguishable in bytecode from a legitimate app.
T1437.001 Web Protocols — C2 uses OkHttp / HttpURLConnection with runtime-supplied URLs.
T1638 Adversary-in-the-Middle — requires runtime network observation.

Sample cohort does not exercise the behavior (3)

T1471 Data Encrypted for Impact — Sova v5’s ransomware module encrypts device files with a runtime-delivered AES key. The samples in this cohort are pre-v5 banking builds and do not carry the encryption module.
T1641.001 Transmitted Data Manipulation (clipboard) — ThreatFabric documents clipboard hijacking (crypto-address swap) in Sova v5+; the ClipboardManager references in this cohort all fire inside bundled utility libraries (WhatsApp clones, React Native / Flutter clipboard modules) rather than in attacker code, so the Sova-authored clipboard-swap logic is not present in these samples.
T1406.002 Software Packing — a distribution characteristic (how the APK is shipped), not a bytecode behavior visible after unpacking.

Behavior confirmed by Quark but attributed to bundled library (2)

T1418 Software Discovery — PackageManager.getInstalledApplications and getPackageInfo fire in Sova’s samples but always inside the Getui push SDK (Lcom/igexin/push/…), which uses the same API to build push-targeting maps. Sova likely reuses the SDK’s cache rather than calling the primitive itself.
T1513 Screen Capture — canvas / bitmap-compress pair fires only inside Lcom/horcrux/svg/SvgView (react-native-svg rendering), not attacker code. Sova’s actual screen capture uses AccessibilityService.takeScreenshot, a single-API surface with the same limitation as the group above.

Runtime impersonation (1)

T1655.001 Match Legitimate Name or Location — impersonating a real app by icon / name / package similarity (e.g. Sova samples disguising as BurgerKing) requires cross-app comparison at install time; out of scope for static bytecode analysis of a single APK.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	15EAE9134DAC9268CBF005C23299C88DD5C5176A240201DA751691A543375360
2	1981394E719BDFD9E29D57386D8CA05CEECC2DDD31F658255C068D6963DF17C1
3	2124777F710199D4051C9D67185DC4DBB55252D65B57642222EEE444C5C06D88
4	376D13AFFCBFC5D5358D39ABA16B814F711F2E81632059A4BCE5AF060E038EA4
5	3EB7EFA71648AE819F1BFF89399717805129487081E8261DD65BF596F2467054
6	6F7E57ED7239905FAFC3947160B5FC89AD615772D2A694299999D2FE080453F4
7	724A56172F40177DA76242EE169AC336B63D5DF85889368D1531F593B658606B
8	795B279F312A773F7F556A978387F1B682F93470DB4C1B5F9CD6CA2CAB1399B6
9	7C805F51EE3B2994E742D73954E51D7C2C24C76455B0B9A1B44D61CB4E280502
10	B01B74AAF249D0740F541C081C0C0DE4BF455B4B68F2634FAB6CF8AAFCD95D52
11	BBAF483C2B6F67F22EB6E1FA00F200E9C1E201B0110070ACAEFD416CF846B1AA
12	EC5B083C017570F846F6925B7C79D9E5886525A9B7BA7E514DABAD0325C0AF5E
13	EFB92FB17348EB10BA3A93AB004422C30BCF8AE72F302872E9EF3263C47133A7
14	F3FC80A8793E60A901DA44B9AB315931699E64A4F3EDDB8ABA839FE860DE46DC

EventBot Malware Family Analysis Report

This report analyses the EventBot malware family using Quark’s rule classification. EventBot is an Android banking trojan and information stealer, first documented by Cybereason in March 2020, that abuses Android’s accessibility service to harvest data from more than 200 banking, money-transfer and cryptocurrency-wallet applications, and reads incoming SMS to defeat two-factor authentication. This run did not generate a new rule for EventBot: the family’s distinctive bytecode patterns (installed-app enumeration, SMS broadcast interception, and SMS-body exfiltration over HTTP) are already covered by Quark’s existing rule set. Check here for the rule set details.

Quark’s rule classification flagged 3 of 3 EventBot samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0478 EventBot software entry. Of the 14 techniques documented for the family, Quark’s static bytecode analysis surfaces the 3 listed below; see the coverage-gap notes at the end of this section for why the other 11 are not demonstrated here.

MITRE Technique	Real-world manifestation in EventBot
T1418 Software Discovery	Enumerating installed applications and persisting the inventory to shared preferences, so the operator can pick which banking apps to target
T1624.001 Broadcast Receivers	Registering an SMS broadcast receiver that fires on every incoming message and hands the intent to a parser
T1636.004 SMS Messages	Reading the SMS body out of the received intent and shipping it to the C2 over HTTP, defeating SMS-based two-factor authentication

All cluster representatives below were extracted from sample 05782e267bd62de78a3db22b1a83ddd3c72cbef95f5a5bc9defdd42a4f5786ec.apk, chosen as the representative sample whose detected behaviors most fully cover the documented profile of EventBot. The other 2 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1418 Software Discovery

MITRE definition (T1418): Adversaries may attempt to get a listing of applications that are installed on a device.

Lcom/example/eventbot/func;regOnWeb — the routine that registers the freshly infected device with the operator’s web panel — calls the helper Lcom/example/eventbot/func;getAllApps, which enumerates every installed application and writes the resulting list into shared preferences. The inventory is then included in the registration payload, letting the operator decide which of EventBot’s 200-plus targeted banking apps are worth attacking on this device.

Behaviors detected by Quark:

Get installed applications and put the list in shared preferences (#00170)
Enumerate installed applications (#00264)

2. T1624.001 Broadcast Receivers

T1624.001 Broadcast Receivers — attack.mitre.org

MITRE definition (T1624.001): Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.

This section covers the trigger mechanism. Lcom/example/eventbot/func;doSMS is the broadcast-receiver entry point: it inspects the incoming intent’s action to confirm an SMS-received broadcast, then dispatches to Lcom/example/eventbot/func;parseSMS. Because the receiver is bound to a system event rather than to app lifecycle, it runs whenever a message arrives, giving EventBot execution without the user opening the app.

Behaviors detected by Quark:

Monitor the general action to be performed (#00025)
Monitor incoming SMS message (#00234)
Read SMS message from Intents (#00260)

3. T1636.004 SMS Messages

T1636.004 SMS Messages — attack.mitre.org

MITRE definition (T1636.004): Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.

This section covers what the receiver collects, once triggered by the mechanism in the previous section. Lcom/example/eventbot/func;parseSMS extracts the message body from the intent and passes it to EventBot’s HTTP sender, which posts it to the C2. This is the step that defeats SMS-based two-factor authentication: one-time codes are read and exfiltrated before or alongside the victim seeing them.

Behaviors detected by Quark:

Monitor the general action to be performed (#00025)
Get SMS message body and send it through http (#00165)
Monitor incoming SMS message (#00234)
Read SMS message from Intents (#00260)

Coverage-gap notes

The 11 MITRE techniques documented for EventBot that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:

The rule’s two APIs are both present, but no single method calls both (4) — Quark confirms a rule only when one method reaches both of its APIs, so it can trace the value from the first call into the second. For each technique below a rule exists and its APIs are present in the samples (Quark’s stage 2 passes), but EventBot splits the work across separate small helpers, so stage 3 never finds a method holding both.

Technique	Rule that partially matched	Where it stopped
T1426 System Information Discovery	#00033 Query the IMEI number, #00038 Query the phone number	Both APIs present; no shared calling method
T1422 System Network Configuration Discovery	#00059 Query the SIM card status	Both APIs present; no shared calling method
T1422.001 Internet Connection Discovery	#00034 Query the current data network type	Both APIs present; no shared calling method
T1513 Screen Capture	screen-capture rules, matched in all three samples	Rules fired, but no method held enough of the chain to anchor a call sequence

Behavior confirmed, but every candidate representative sat in bundled library code (2) — the evidence exists and passed validation, but the methods holding it belong to third-party code, so attributing the behavior to EventBot would be wrong.

Technique	What was found	Why it was dropped
T1407 Download New Code at Runtime	Dynamic class loading plus method reflection, in the obfuscated sample	That sample’s class names are ProGuard-minified, so its parents cannot be separated from shaded library code
T1437.001 Web Protocols	HTTP POST carrying the SMS body and sender address	The representative parent landed in the bundled HTTP stack. The underlying evidence still appears in this report — rule #00165 is cited under T1636.004 above

No rule in the current pool targets the technique (2)

T1521.001 Symmetric Cryptography and T1406 Obfuscated Files or Information — the rule pool currently contains no rule describing symmetric-encryption or payload-obfuscation behavior, so neither technique was exercised at all.

The samples do not exhibit the behavior (3) — these are honest non-detections rather than tooling limits. Cybereason documented EventBot as still under active development when discovered, and the capabilities below are absent from the builds in this cohort.

Technique	What the samples actually do	What the technique requires
T1417.001 Keylogging	Accessibility UI inspection — `getRootInActiveWindow`, reading node text and content descriptions	An input-capture primitive; reading the view tree is not the same as recording keystrokes
T1417.002 GUI Input Capture	Passive dimension queries (navigation-bar and status-bar heights)	An overlay window or input interception
T1655.001 Match Legitimate Name or Location	Hiding the launcher icon	Evidence of impersonating a specific legitimate app by name, icon or package; icon hiding alone is generic

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	05782E267BD62DE78A3DB22B1A83DDD3C72CBEF95F5A5BC9DEFDD42A4F5786EC
2	1A8C17AD1A790554278B055BDB946D4597BA9AF6BE3611EE6311B90C7F7848C5
3	E6E736DF1923C47F6624DAB18BF6A341995B5E756395256AA0B3F4C43594481A

Skygofree Malware Family Analysis Report

This report analyses Skygofree malware family using Quark’s rule classification. Skygofree is a multi-stage Android surveillance implant documented by Kaspersky in 2018 and attributed to an Italian IT company selling offensive software. It is delivered through fake mobile-operator pages and, once installed, records audio and video on command, steals files from messaging applications, and downloads further modules from its command and control server. This run did not generate a new rule for Skygofree: the family’s surveillance primitives are already covered by Quark’s existing rule set. Check here for the rule set details.

Quark’s rule classification flagged 2 of 2 Skygofree samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

The behaviours below are referenced from MITRE ATT&CK® Mobile — S0327 Skygofree.

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0327 Skygofree software entry. Of the 8 techniques documented for the family, Quark’s static bytecode analysis surfaces the 4 listed below; see the coverage-gap notes at the end of this section for why the other 4 are not demonstrated here.

MITRE Technique	Real-world manifestation
T1429 Audio Capture	Recording ambient audio and phone calls when device enters specific locations
T1409 Stored Application Data	Stealing message databases and files belonging to other installed applications
T1407 Download New Code at Runtime	Fetching additional surveillance modules from command and control infrastructure on demand
T1512 Video Capture	Recording video through device cameras triggered by attacker commands or conditions

All behavior maps below were rendered from sample e6aba7629608a525b020f4e76e4694d6d478dd9561d934813004b6903d66e44c.apk (package com.sysmanager) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Skygofree. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1409 Stored Application Data — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

https://i.ibb.co/7NxDBrWZ/t1429-audio-capture.png

startRecording directly initializes the recorder and starts recording audio. This call enables the service to capture ambient sound from the device microphone.

Behaviors detected by Quark:

Initialize the recorder and start recording (#00198)

2. T1409 Stored Application Data

MITRE definition (T1409): Adversaries may try to access and collect application data resident on the device.

https://i.ibb.co/V00MgYR0/t1409-stored-application-data.png

run calls one helper to read files into streams, retrieve absolute paths, and package file data into JSON objects. Together, these calls enable the malware to access application data files and prepare them for upload.

Behaviors detected by Quark:

Read file and put it into a stream (#00013)
Read file into a stream and put it into a JSON object (#00014)
Get absolute path of the file and store in string (#00020)
Open a file from given absolute path of the file (#00022)

3. T1407 Download New Code at Runtime

T1407 Download New Code at Runtime — attack.mitre.org

MITRE definition (T1407): Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores.

https://i.ibb.co/67CVJM1L/t1407-download-new-code-at-runtime.png

doInBackground calls one helper to write HTTP input streams to disk and install APKs from those files. Together, these calls enable the malware to download and install additional applications at runtime.

Behaviors detected by Quark:

Install other APKs from file (#00054)
Write HTTP input stream into a file (#00072)

4. T1512 Video Capture

T1512 Video Capture — attack.mitre.org

MITRE definition (T1512): An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with the device cameras through an available API provided by the operating system.

https://i.ibb.co/21BVMdt0/t1512-video-capture.png

takePic directly configures camera parameters, sets the preview texture, and starts capturing preview frames to the screen. Together, these calls enable the malware to activate the camera and capture visual data.

Behaviors detected by Quark:

Get current camera paremeters and change the setting. (#00183)
Set camera preview texture (#00184)
Start capturing camera preview frames to the screen (#00185)

Coverage-gap notes

The 4 MITRE techniques documented for Skygofree that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:

The evidence Quark collected does not demonstrate the technique (2) — T1404 Exploitation for Privilege Escalation and T1644 Out of Band Data.

For T1404, sample af848999… downloads a program from its server and runs it through a shell to gain root, in Lcore/syncsystem/methods/Priv$2;run. Quark does reach that code and fires “Executes the specified string Linux command”, because Runtime.exec is an API it can match. The shell command itself, though, is assembled at runtime and handed to exec as a string argument — Runtime.exec(["/system/bin/sh", "-c", <command>]) — and Quark’s rules match API calls, not the strings passed to them. Quark therefore sees that a command ran but never which one, so running an exploit and listing a directory look identical to it.

For T1644, Quark did cluster SMS handling in Lcom/sysmanager/system/SmsReceiver;onReceive, but that cluster reads and filters incoming messages. T1644 requires receiving command and control instructions over binary SMS, which the collected primitives do not show.

Both APIs are present, but no single method passes data between them (1) — T1430 Location Tracking. Quark’s rules for this technique pair Location.getLatitude with Location.getLongitude. Both APIs exist in the samples and Quark reaches stage 3, but no method calls both and passes a value from one to the other, so the match stops short of the data-flow stage that a confirmed detection requires.

The behavior is real but not separable from a technique already shown (1) — T1437.001 Web Protocols. Skygofree’s HTTP command and control traffic is genuine, and Quark confirms it inside Lcom/sysmanager/network/ classes such as GetCommands and StartReverse. The primitives collected there — open a URL, set a request method, read the response stream — are the generic transport that T1407’s download step already rests on, rather than evidence specific to command and control signalling, so no separate cluster was attributed to this technique.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	AF848999A4B8DF0E33F5A05A618C83D1F3052D4026AB77B2ACF66DEF71DF754E
2	E6ABA7629608A525B020F4E76E4694D6D478DD9561D934813004B6903D66E44C

Chrysaor Malware Family Analysis Report

This report analyses the Chrysaor malware family using Quark’s rule classification. Chrysaor is the Android build of the Pegasus spyware developed by NSO Group, documented by Lookout and Google in 2017. It is delivered as a targeted implant that records audio, reads stored messages, and can remove its own traces on command. This run did not add a new rule for Chrysaor. Check here for the rule set details.

Quark’s rule classification flagged 2 of 2 Chrysaor samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

The behaviours below are referenced from MITRE ATT&CK® Mobile — S0316 Pegasus for Android.

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0316 Pegasus for Android software entry — Chrysaor is MITRE’s alias for the same implant. Of the 14 techniques documented for the family, Quark’s static bytecode analysis confirms the 2 listed below; see the coverage-gap notes at the end of this section for why the other 12 are not demonstrated here.

MITRE Technique	Real-world manifestation
T1429 Audio Capture	Recording ambient audio and phone calls for surveillance and intelligence gathering
T1422.001 Internet Connection Discovery	Checking whether the device currently has an active network connection

All behavior maps below were rendered from sample ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5.apk (package com.network.android) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Chrysaor. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1422.001 Internet Connection Discovery — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

https://i.ibb.co/JWLCZf1P/t1429-audio-capture.png

Lcom/network/android/roomTap/AutoAnswerReceiver;c directly initializes the recorder and starts recording. This call enables the receiver to capture ambient audio without user interaction.

Behaviors detected by Quark:

Initialize the recorder and start recording (#00198)

2. T1422.001 Internet Connection Discovery

MITRE definition (T1422.001): Adversaries may check for Internet connectivity on compromised systems.

https://i.ibb.co/N62JdkGT/t1422-001-internet-connection-discovery.png

Lcom/network/f/a;a directly checks for network connectivity. This call enables the malware to determine whether an active network connection is available.

Behaviors detected by Quark:

Check for network connectivity (#00224)

Coverage-gap notes

The 12 MITRE techniques documented for Chrysaor that this report does NOT demonstrate, grouped by the reason Quark could not confirm them:

What makes it malicious is in the text, not the call (2) — T1404 Exploitation for Privilege Escalation and T1636.002 Call Log. Lcom/network/android/m runs shell commands and Quark sees the call, but a shell call looks the same whatever it runs. T1636.002 fails the same way: the rules that fired cover the SMS and call-log providers together, because both are reached through one API with a different URI string.

The samples do not exhibit the behaviour (7) — T1409 Stored Application Data, T1418 Software Discovery, T1422 System Network Configuration Discovery, T1422.002 Wi-Fi Discovery, T1636.001 Calendar Entries, T1644 Out of Band Data and T1645 Compromise Client Software Binary. These samples do not carry these behaviours, so there is nothing for Quark to detect.

The two calls happen but nothing is passed between them (3) — T1512 Video Capture, T1624.001 Broadcast Receivers and T1636.003 Contact List. Each reaches stage 4: one method makes both calls, in the right order. The camera object, for one, travels through wrapper methods instead of going straight from the first call to the second, so Quark cannot link them.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	ADE8BEF0AC29FA363FC9AFD958AF0074478AEF650ADEB0318517B48BD996D5D5
2	BD8CDA80AAEE3E4A17E9967A1C062AC5C8E4AEFD7EAA3362F54044C2C94DB52A

Dendroid Malware Family Analysis Report

This report analyses the Dendroid malware family using Quark’s rule classification. Dendroid is a commercial Android RAT sold on underground forums from 2014, whose source code later leaked and seeded a number of derivatives. It is operated through a web panel and disguises itself as a parental-control application. This run did not add a new rule for Dendroid. Check here for the rule set details.

Quark’s rule classification flagged 2 of 2 Dendroid samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. Please check here for the APKs we tested.

Identified Well-Known Threats

The behaviours below are referenced from MITRE ATT&CK® Mobile — S0301 Dendroid.

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0301 Dendroid software entry. Of the 8 techniques documented for the family, Quark’s static bytecode analysis confirms the 3 listed below; see the coverage-gap notes at the end of this section for the other 5.

MITRE Technique	Real-world manifestation
T1429 Audio Capture	Recording ambient audio or phone calls via microphone access for surveillance
T1533 Data from Local System	Reading stored communication records — sent messages and call logs — from the device’s own providers
T1636.004 SMS Messages	Harvesting SMS message content including authentication codes and personal communications

All behavior maps below were rendered from sample 099a57328de9335c524f44514e225d50731c808145221affdd684d8b4dad5a1d.apk (package com.parental.control.v4) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Dendroid. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample’s bytecode, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture