Remember the video in where we have created an AP Kape payload in MSF venom?
Well, you can do the same by injecting a legit app with this payload.
So as you can see here, this is the command we used to inject a legit application here.
The application is CRM, that HBK.
It is the same command I've used earlier.
This has to have hyphen here for that.
So MRSA venom, you're injecting this CRM dot PPK with the reverse DCP Android payload.
And here you have to put your IP and port tumbler.
And this is the output so you can do the same for any HBK you can extract from your phone, you download
from the Internet, you download from a Picchi, Mary, etc., even for the famous ones like WhatsApp
and Facebook.
So we just run it here.
You inject it with the payload end and there you go.
Now I want to tell you about a mobile framework.
I'll be showcasing now.
It's called Mobile Security Framework and OBSS.
You can find it here on Get Hub.
I'll share the stock because it's origin sold on my machine here to install it, to just have just copy
paste.
These commands first installed Python three.
Then Dash V and V.
Then you clone it from the repository and get hub.
Then you let me go here with you now.
So I'll open the terminal.
I'll go.
S I'll see these to the mobile security framework.
I'll do LSD again to run it for the first time.
You just have to do dot forward slash and setup dot as h but not what's already there.
I'll do run those dots as H instead.
So once you run it it will let me do that again because in the Cali user, not the route.
So once you do that, the service will start and it will be accessible on local hosts.
Eight thousand PT. Just copy that.
Go to your browser and just base your L.
And here we go.
This is the main interface.
Now you can upload any HBK you want to analyze.
For example, you have two AP versions before the payload and after the payload, anything.
So you just we will upload an API key here, the one that we have created earlier, Jordan signed with
B.K..
And let's see the result of such analysis.
It came very fast.
So it will tell us here an overview on the application, one activity, one service or receiver.
Let's go down a bit.
It will tell us the application is signed.
These are the details of the signature.
If you go down, here comes the important information.
This is the Android manifest.
Ximo file.
It will automatically highlight the dangerous permissions.
So you're doing static malware analysis.
But with the help of a tool here, the dangerous permissions are highlighted in red.
And there is a description and explanation next to it going down.
It will tell you as well some analysis of the structure of the application.
So the H2 G.P.S. connections are found in this Java file here.
So this Java without it will tell it to give you a guideline on how to do the static malware analysis.
It's a very helpful to the sockets as well, can be found in this file and so forth.
This is a very important piece of information for our static analysis going down here.
It will highlight the issues.
For example, we have a broadcast receiver issue and a service issue.
These are shared between this application and the other and the severity is high going down as well.
It will highlight another issues related to the hashing or the encryption being used.
It's we caching.
Here is the app uses an insecure random generation number.
So again, it's a very important tool that will give you all these important information.
You can take it further by doing your own analysis.
So if the I think let me see here as well, if the application is using Eskil light, it will tell you
all the information on that aspect here.
So you can't upload the malicious SPCA or the AP.
Kaney question to virus total, for example.
So do the analysis.
But this tool will go one step further to perform that.
Keep in mind here that this tool can be downloaded as a Docker version.
The Docker version only have static analysis and not dynamic analysis.
So feel free to play around with the tool.
It's really helpful and it will give you much more insights on what's going on in an application.