Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Leveraging a Hooking Framework to Expand Malware Detection Coverage on the Android Platform

Summary: Unit 42 researchers describe building a hooking framework that intercepts Android Framework API calls at runtime to deobfuscate malware, and note a VirusTotal search found 12,394 malicious APK samples between August 27 and September 7, 2023, with minimum API level requirements ranging from 19 to 30. They illustrate the problem with a Cerberus banking Trojan sample (SHA-256 1249c4d3a4b499dc8a9a2b3591614966145daac808d440e5202335d9a4226ff8) that hides its name behind five whitespace characters and obfuscates configuration strings with Base64 encoding layered over RC4 encryption.

Why it matters: The samples span API levels 19 through 34 in the researchers' own telemetry, and Google's annual target API enforcement means that spread will persist - so a sandbox pinned to specific Android versions will keep losing coverage as new levels ship.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related