So far we've seen static and dynamic analysis. 1
What we're going to show you next is a malware sandbox. 2
More specifically an online malware sandbox. 3
There are a few malware sandboxes available online here we'll just show you a few so there is this platform 4
called koodous. 5
Dot com. 6
This is quite research oriented and it has this interesting malware analysis collaboration concept. 7
It is still in beta version and has been for a while but it's still useful especially as a resource 8
for malware samples. 9
There is another tool called APKlab.io that is actually made by Avast it is quite a new tool 10
and it's probably not in beta anymore. 11
I believe they have a registration process but we were able to obtain an account easily enough. 12
So you just need to send an email with a registration request. 13
Then there are other public sandboxes for example AmAaaS 14
Not sure how to pronounce that. 15
And Sandroid, so with all of these tools you can get an APK , you upload it and it automatically performs 16
static and dynamic analysis for you and produces a report. 17
The report will show you what potentially malicious behavior was identified through static and dynamic 18
analysis so these are publicly available and they're online in the near future in a more advanced course 19
we'll go into more detail about more advanced analysis techniques but also more importantly we'll go 20
through the steps of setting up your own automated malware analysis sandbox so you can locally set up 21
and host your own local instance of a tool similar to these. 22
There are many advantages to this, a main one is that you can also do a semi automated analysis where 23
you would be able to execute in an apk but also interact with it while observing the behavior within 24
this analysis. Even though there is an automated analysis available, 25
everything we've done so far in terms of static and dynamic analysis is very important because at the 26
end of the day you need to understand what is going on in the background and a fully automated approach 27
is never a silver bullet. 28
Sometimes you have to dissect an app in order to really understand what it is doing. 29
OK let's try to upload the APK to APKlab and koodous. Set up your own accounts let's start off with 30
koodous then upload the APK okay like so we're going to do the same thing to APKlab dot Io. 31
Actually here we can drop it and it is uploaded actually let's do the same thing in AMaaaS. Log in using 32
their account upload the signed APK choose the file and click on static and dynamic analysis here. You 33
can choose monkey or UI automation these are two different techniques they're just different tools that 34
are used during the dynamic analysis to recreate the user interaction with the app. 35
This is used to expose as much behavior as possible. 36
Imagine a scenario where most of the malicious activity is based on the user clicking on a specific 37
button. 38
If the click is not automated then the malicious activity would not be exposed if the analysis environment 39
simply opens the app but doesn't click on any user interface elements. 40
Then there's a possibility that code doesn't get triggered and if the code doesn't get triggered then 41
the indicators will not be exposed during the dynamic analysis. 42
OK so same thing on Sandroid just click upload here select file upload so these are for different public 43
sandboxes. We can use different ones and compare the reports eventually just choose whichever one you 44
prefer. 45
Let's give them some time because since they're running the dynamic analysis in the background we have 46
to give them time to analyze and we'll get back to the results later.