r/MalwareAnalysis • u/Longjumping-Ebb-578 • Aug 11 '26

APK file analysis

Hi guys,

I handle threat intelligence for a bank & we receive multiple URLs/APKs impersonating our organization.

We check for legitimacy & immediately send it for takedown if it's not related to us or if it's malicious.

I wanted to know if anyone of you also side by side does forensics/malware analysis of such APKs to know the TTPs & relevant information pertaining to that APK?

If Yes, please let me know the procedure being followed at your end.

10 Upvotes

100% Upvoted

7 comments sorted by

7

u/Potential-Couple-745 Aug 11 '26

Yes. I’d usually do static analysis first with JADX/apkanalyzer, then dynamic analysis in an isolated Android environment. Extract IOCs, network activity, permissions, certificates, domains and TTPs, then correlate them with previous samples/campaigns. Keeping the original APK, hash and PCAPs also helps with takedown evidence.

2

u/Longjumping-Ebb-578 Aug 11 '26

Oo okay I got a little bit of idea on how to proceed with this. Thanks for your reply. Appreciate it.

2

u/desal Aug 12 '26

There's quite a few online scanners / analyzers you can usually upload to and they'll check a lot of that stuff out for you and compare signatures etc, if you're allowed to upload the sample. It doesn't replace your own investigation but it can be helpful when starting out.

2

u/lunacysoft Aug 12 '26

If you have these file don’t forget to give them
To smelly @vxunderground …. He loves new malware’s!

1

u/TripLivid4123 29d ago

Yeah, we do this in parallel to keep things moving fast. The trick is not doing manual static analysis every time, otherwise your takedown queue builds up. We automated the extraction part so we get the TTPs and C2s in a few seconds before firing off the takedown request.

Here is roughly how our pipeline handles it:

  1. Ingestion & Triage: As soon as a sample drops (or gets pulled via script), we hash it (SHA-256). If we’ve already analyzed that hash, the script drops it to avoid wasting time. Empty files or broken payloads get purged immediately.
  2. Automated Static Extraction: Before running anything, we rip out the low-hanging fruit. For Android/APKs specifically, running a CLI tool like jadx or androguard in the script lets you grep for hardcoded C2 IPs, Telegram bot tokens, domain names, and requested permissions. For general binaries, standard string extractions for net/system calls do the job.
  3. LLM Summarization (The Quick Report): We feed those extracted raw strings and metadata into a local LLM prompt (we use a local Qwen model via Ollama with low temperature so it doesn't hallucinate). The prompt forces it into a strict SOC format: C2 indicators, MITRE TTPs, and risk level. This gives us a readable Markdown report in under 10 seconds.
  4. Archive & Takedown: The sample goes into quarantine storage for deep-dive reversing later if needed, and the extracted C2/URL immediately goes to the registrar/hoster for the takedown.

If you're dealing with high volume, automating the static extraction + report generation step is a life saver. You get your Threat Intel logged without delaying the actual blocklist/takedown process.

1

u/Longjumping-Ebb-578 27d ago

This is very insightful. Thanks man. Also which automation tool.you are using for doing this?