reverse-engineering-android-malware-with-jadx

使用 JADX 逆向分析 Android 恶意软件

适用场景

• 有报告指出某个可疑 Android APK 含有恶意软件，或移动威胁检测将其标记为恶意软件
• 分析 Android 银行木马、间谍软件、短信窃取程序或广告软件样本
• 确定应用收集哪些数据、将数据发送到哪里，以及滥用哪些权限
• 从 Android 恶意软件中提取 C2 服务地址、加密密钥和配置数据
• 了解银行木马使用的覆盖层攻击机制

不要用于分析 APK 中经过混淆的原生（.so）库；分析原生 ARM 二进制文件请使用 Ghidra 或 IDA。

前置条件

• 已安装 JADX 1.5+（从 https://github.com/skylot/jadx/releases 下载）
• 已安装 Android SDK，包含用于检查 APK 的 aapt2 和 adb 工具
• 已安装 apktool，用于完整反汇编 APK，包括 smali 代码和资源
• 已安装 Python 3.8+，并安装 androguard 库，用于自动化 APK 分析
• 已安装 Frida，用于动态插桩（可选，用于运行时分析）
• 已隔离的 Android 模拟器（Genymotion 或 Android Studio AVD），不含 Google 服务

工作流

步骤 1：提取 APK 元数据和权限

检查 APK 结构和 AndroidManifest.xml：

# Get APK basic info
aapt2 dump badging malware.apk

# Extract AndroidManifest.xml
apktool d malware.apk -o apk_extracted/ -f

# Analyze permissions with androguard
python3 << 'PYEOF'
from androguard.core.apk import APK

apk = APK("malware.apk")

print(f"Package:    {apk.get_package()}")
print(f"App Name:   {apk.get_app_name()}")
print(f"Version:    {apk.get_androidversion_name()}")
print(f"Min SDK:    {apk.get_min_sdk_version()}")
print(f"Target SDK: {apk.get_target_sdk_version()}")

# Dangerous permissions
dangerous_perms = {
    "android.permission.READ_SMS": "SMS theft",
    "android.permission.RECEIVE_SMS": "SMS interception",
    "android.permission.SEND_SMS": "Premium SMS fraud",
    "android.permission.READ_CONTACTS": "Contact harvesting",
    "android.permission.READ_CALL_LOG": "Call log theft",
    "android.permission.RECORD_AUDIO": "Audio surveillance",
    "android.permission.CAMERA": "Camera surveillance",
    "android.permission.ACCESS_FINE_LOCATION": "Location tracking",
    "android.permission.READ_PHONE_STATE": "Device fingerprinting",
    "android.permission.SYSTEM_ALERT_WINDOW": "Overlay attacks",
    "android.permission.BIND_ACCESSIBILITY_SERVICE": "Full device control",
    "android.permission.REQUEST_INSTALL_PACKAGES": "Sideloading apps",
    "android.permission.BIND_DEVICE_ADMIN": "Device admin abuse",
}

print("\nDangerous Permissions:")
for perm in apk.get_permissions():
    if perm in dangerous_perms:
        print(f"  [!] {perm}")
        print(f"      Risk: {dangerous_perms[perm]}")
    elif "android.permission" in perm:
        print(f"  [*] {perm}")

# Components
print("\nActivities:")
for act in apk.get_activities():
    print(f"  {act}")

print("\nServices:")
for svc in apk.get_services():
    print(f"  {svc}")

print("\nReceivers:")
for rcv in apk.get_receivers():
    print(f"  {rcv}")
PYEOF

步骤 2：使用 JADX 反编译

在 JADX 中打开 APK，分析 Java/Kotlin 源代码：

# Open in JADX GUI
jadx-gui malware.apk

# Command-line decompilation for scripted analysis
jadx -d jadx_output/ malware.apk --show-bad-code

# Decompile with all options
jadx -d jadx_output/ malware.apk \
  --deobf \
  --deobf-min 3 \
  --deobf-max 64 \
  --show-bad-code \
  --threads-count 4

# The output directory structure:
# jadx_output/
#   sources/           <- Decompiled Java source code
#     com/malware/app/
#       MainActivity.java
#       C2Service.java
#       SMSReceiver.java
#   resources/         <- Decoded resources (layouts, strings, assets)
#     AndroidManifest.xml
#     res/
#     assets/

步骤 3：识别恶意功能

在反编译的源代码中搜索可疑代码模式：

# Search for network communication
grep -rn "HttpURLConnection\|OkHttpClient\|Retrofit\|Volley\|URL(" jadx_output/sources/

# Search for SMS operations
grep -rn "SmsManager\|getDefault().sendTextMessage\|SMS_RECEIVED" jadx_output/sources/

# Search for overlay attack code
grep -rn "SYSTEM_ALERT_WINDOW\|TYPE_APPLICATION_OVERLAY\|WindowManager.LayoutParams" jadx_output/sources/

# Search for accessibility service abuse
grep -rn "AccessibilityService\|onAccessibilityEvent\|performAction" jadx_output/sources/

# Search for data exfiltration
grep -rn "getDeviceId\|getSubscriberId\|getSimSerialNumber\|getLine1Number" jadx_output/sources/

# Search for crypto operations (key storage, encryption)
grep -rn "SecretKeySpec\|Cipher.getInstance\|AES\|DES\|RSA" jadx_output/sources/

# Search for dynamic code loading
grep -rn "DexClassLoader\|PathClassLoader\|loadDex\|loadClass" jadx_output/sources/

# Search for obfuscated strings and decryption
grep -rn "Base64.decode\|decrypt\|decipher\|xor" jadx_output/sources/

步骤 4：分析 C2 通信

追踪网络通信逻辑：

# Automated C2 extraction from decompiled code
import os
import re

jadx_dir = "jadx_output/sources"

# Patterns for C2 URLs and IPs
url_pattern = re.compile(r'https?://[^\s"\'<>]+')
ip_pattern = re.compile(r'"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"')
base64_pattern = re.compile(r'"([A-Za-z0-9+/]{20,}={0,2})"')

urls = set()
ips = set()
b64_strings = set()

for root, dirs, files in os.walk(jadx_dir):
    for fname in files:
        if fname.endswith('.java'):
            filepath = os.path.join(root, fname)
            with open(filepath, 'r', errors='ignore') as f:
                content = f.read()

            for match in url_pattern.finditer(content):
                urls.add(match.group())
            for match in ip_pattern.finditer(content):
                ips.add(match.group(1))
            for match in base64_pattern.finditer(content):
                b64_strings.add(match.group(1))

print("URLs found:")
for u in urls:
    print(f"  {u}")

print("\nIP addresses:")
for ip in ips:
    print(f"  {ip}")

# Decode Base64 strings
import base64
print("\nDecoded Base64 strings:")
for b64 in b64_strings:
    try:
        decoded = base64.b64decode(b64).decode('utf-8', errors='ignore')
        if any(c.isprintable() for c in decoded) and len(decoded) > 3:
            print(f"  {b64[:30]}... -> {decoded[:100]}")
    except:
        pass

步骤 5：检查原生库

检查是否存在可能包含其他恶意逻辑的原生代码：

# List native libraries in the APK
unzip -l malware.apk | grep "\.so$"

# Extract native libraries
unzip malware.apk "lib/*" -d apk_native/

# Check native library properties
file apk_native/lib/armeabi-v7a/*.so
readelf -d apk_native/lib/armeabi-v7a/*.so | grep NEEDED

# Strings from native libraries
strings apk_native/lib/armeabi-v7a/libpayload.so | grep -iE "(http|url|key|encrypt|password)"

# For deep native analysis, import into Ghidra:
# File -> Import -> Select .so file -> Select ARM architecture

步骤 6：记录分析结果并提取 IOC

编写全面的 Android 恶意软件分析报告：

Analysis documentation should include:
- APK metadata (package name, version, signing certificate)
- Permission analysis with risk assessment
- Component analysis (activities, services, receivers, providers)
- Decompiled code walkthrough of malicious functions
- C2 communication protocol and endpoints
- Data exfiltration methods and targeted data types
- Persistence mechanisms (device admin, accessibility service)
- Evasion techniques (emulator detection, root detection)
- Extracted IOCs (C2 URLs, domains, IPs, signing certificate hash)

核心概念

术语	定义
APK（Android 安装包）	Android 应用程序包格式，包含已编译的 DEX 字节码、资源、清单和原生库
DEX 字节码	Dalvik Executable 格式，包含已编译的 Java/Kotlin 代码；JADX 可将其还原为可读的 Java 源代码
覆盖层攻击	银行木马使用的一种技术，通过在合法银行应用上显示伪造的 UI 层，利用 SYSTEM_ALERT_WINDOW 权限窃取凭据
滥用无障碍服务	恶意软件将自身注册为无障碍服务，以捕获屏幕内容、执行操作并阻止卸载
Smali	DEX 字节码的人类可读表示形式；apktool 使用的字节码与 Java 之间的中间表示
动态代码加载	在运行时使用 DexClassLoader 加载额外的 DEX 代码，以将恶意功能隐藏在静态分析之外
滥用设备管理员权限	恶意软件请求设备管理员权限，以阻止卸载并实施设备擦除威胁

工具和系统

• JADX：开源 DEX 到 Java 反编译器，提供用于 Android APK 分析的 GUI 和 CLI，并支持反混淆
• apktool：用于对 Android APK 文件进行逆向工程并还原为 smali 代码和解码资源的工具
• androguard：用于自动化 Android APK 分析的 Python 框架，包括权限、组件和代码分析
• Frida：动态插桩工具包，可在 Android 运行时挂钩 Java 方法和原生函数
• MobSF（Mobile Security Framework）：用于静态和动态分析的自动化移动应用安全测试框架

常见场景

场景：分析 Android 银行木马

背景：某银行木马 APK 通过短信钓鱼攻击特定银行的客户。需要分析该样本，以识别目标银行、C2 基础设施和数据窃取机制。

方法：

1. 提取 APK 元数据并识别请求的权限（短信、无障碍、悬浮窗、设备管理员）
2. 使用 JADX 反编译，并搜索模仿银行应用界面的悬浮窗 Activity 类
3. 在代码中搜索软件包名称列表，识别目标银行应用列表
4. 跟踪短信拦截接收器，了解其如何窃取 2FA 验证码
5. 跟踪 C2 通信代码，提取服务器 URL 和命令协议
6. 检查 assets/ 目录中的网页注入配置文件
7. 提取所有 IOC 并记录完整的攻击链

注意事项：

• 分析前未对类名和方法名进行反混淆（使用 JADX --deobf 标志）
• 漏掉安装后下载的动态加载 DEX 文件
• 忽略可能包含实际 C2 逻辑或加密例程的原生 .so 库
• 忽略可能包含加密配置或网页注入代码的 assets/ 目录

输出格式

ANDROID MALWARE ANALYSIS REPORT
==================================
APK File:         update_bank.apk
Package:          com.android.systemupdate
SHA-256:          e3b0c44298fc1c149afbf4c8996fb924...
Version:          1.2.3
Min SDK:          21 (Android 5.0)
Signing Cert:     SHA-256: abc123... (self-signed)

CLASSIFICATION
Family:           Anubis Banking Trojan
Type:             Banking Trojan / SMS Stealer / Keylogger

DANGEROUS PERMISSIONS
[!] RECEIVE_SMS          - Intercepts incoming SMS (2FA theft)
[!] READ_SMS             - Reads SMS messages
[!] SEND_SMS             - Sends premium SMS
[!] SYSTEM_ALERT_WINDOW  - Overlay attacks on banking apps
[!] BIND_ACCESSIBILITY   - Full device control
[!] BIND_DEVICE_ADMIN    - Prevents uninstallation

MALICIOUS COMPONENTS
Service:    com.android.systemupdate.C2Service (C2 communication)
Receiver:   com.android.systemupdate.SmsReceiver (SMS interception)
Activity:   com.android.systemupdate.OverlayActivity (credential overlay)

TARGETED APPS (23 banking apps)
com.bank.example1, com.bank.example2, ...

C2 INFRASTRUCTURE
Primary:    hxxps://c2-server[.]com/api/bot
Fallback:   hxxps://backup-c2[.]net/api/bot
Protocol:   HTTPS POST with JSON body
Bot ID:     MD5(IMEI + Build.SERIAL)

EXTRACTED IOCs
Domains:    c2-server[.]com, backup-c2[.]net
IPs:        185.220.101[.]42
URLs:       hxxps://c2-server[.]com/api/bot
            hxxps://c2-server[.]com/api/injects
Cert Hash:  abc123def456...