So the first sandbox analysis to finish was the one at APKlab.IO. 1
Here you can see the results. 2
Let's have a look at the general dashboard over here OK so basic stuff. 3
It tells you there are two activities one server and one receiver. 4
It shows what permissions are being used shows you what you are l the malware is connecting to usually 5
this is the kind of stuff you'd want to try to identify by going through code. 6
So this is a really good start. 7
As an analyst this is an ideal scenario. 8
You upload malware let it run and see the results then besides the general dashboard you have more detailed 9
results. 10
For example static analysis actually before we see this let's have a look at koodous. In Koodous you can 11
search for APKs including the one you just uploaded. 12
So here we have the hash of the APK and we can just search using this. 13
So you might see that no analysis was done for a specific APK in that case. 14
Just click analyse or reanalyze if you want a new analysis like so 15
and an analysis request has been sent, report generation can take several minutes but it will give you 16
a notification when it finishes so you'll probably get an e- mail report saying okay your analysis is 17
complete. I'll just show you the results in one of the sandboxes which I think is one of the best ones 18
actually APKLab.Io but whatever you see in APKlab you'll probably see similar results in the 19
other sandboxes. At the end of the day in the background 20
all of them are doing similar tasks and using similar tools. 21
However APKlabs seems to be quite a serious and advanced tool. Technically in the background, 22
they're using the tools we showed you earlier while providing the user with a UI 23
I believe APKlab goes a step further and they apply some advanced analysis maybe using some A.I. 24
Oh and the other thing about the sandboxes. 25
As I mentioned earlier they're also good sources for actual malware. 26
So if you want to analyze a specific malware you can go to an online sandbox search by name package 27
MD5 etc and find your sample. 28
Since these are public repositories they're receiving malware samples from all over the world. 29
So for example if you want to find a stagefright sample just come here and search stagefright or do 30
some research and find the hashes for stagefright and search here or you can use tags. 31
For example you're researching fake installers so search tag colon fake dash installer and you'll find 32
several samples so let's have a look at the analysis reports that APKlab generated under the static 33
analysis. 34
It gives you some basic information about the application suspicious permissions. 35
It tells you that it goes through S M S's on receipt 36
Creates SMS data. 37
Again related to SMS queried contacts. 38
So again here it is telling you to be careful it's reading your contacts over here. 39
This was all done automatically. 40
OK what else. 41
URL strings. 42
This is quite interesting too. OK. 43
So from the static automated analysis we just saw that it reads S M S's. 44
It reads contacts and it sends data to postman dash echo. 45
This is all information that we saw in the building a basic Android apps section. 46
But remember usually as analysts we are not aware of what the developer did. 47
So we are working blindly and all of this info is valuable. 48
OK now let's look at dynamic.. so it says that they ran it on Android 6. 49
Here we have network stats showing where data is being exposed traded to so it's interesting to see 50
if data is coming from or going to a specific country network dumb. 51
So we can download it and see more info on the traffic data. Permissions. 52
Again here it sees what permissions where requested but more importantly which ones were used. 53
Entry points. 54
This provides info about the components together with screenshots. 55
OK. 56
This is a lot of information that we got from an automated analysis for the analyst. 57
This is great. 58
You upload the app and you have all this info about the app's behavior. 59
Now while it doesn't provide a full picture it does give you good insight on where you should go to 60
look deeper. 61
So for example this here tells you that there is a receiver if you want to look deeper you can do some 62
static analysis manually on top of it. 63
We can use byte code viewer or other tools we saw earlier and dig deeper. So here we saw an automated 64
online malware sandbox in an upcoming course that we're preparing, 65
we'll show you how to set up your own malware sandbox. So you could develop your own Android malware 66
sandbox but in your own local environment there are definitely some advantages to this. 67
If you're testing an application that is targeted at your organization maybe you don't want to upload 68
it to a public repository so you could obtain the same results 69
but in your contained environment instead. There are also some other advantages. 70
So for example here you have no control over the interaction with the sandbox. 71
Whereas if you set up your own environment you can interact with the malware as the analysis is being 72
conducted so you can click buttons, log into websites or apps run several apps and so on. 73
This is not always possible with online sandboxes. 74
Since we have no control over the emulator or devices running the analysis 75
another advantage is that you can setup a proxy to intercept HTTP s traffic which is extremely useful 76
for network analysis. 77
You can also perform instrumentation to bypass cert pinning to ensure that you are in fact able to intercept 78
HTTPs. All of this is more advanced and doesn't really belong in an introductory course like this. 79
But if you liked this course then you'll definitely find our more advanced one extremely interesting.