What problem does it solve?
Security analysts need a structured way to determine whether a suspicious mobile application is malware, but manual triage of APK/IPA samples is slow and easily misses evasive behaviors like delayed payloads, encrypted C2 traffic, and dynamic code loading.
Core Features & Use Cases
- Static Indicator Analysis: Hash samples, query VirusTotal, and audit AndroidManifest permissions for high-risk combinations like READ_SMS plus INTERNET.
- Runtime Behavior Monitoring: Use Frida hooks to observe SMS sending, file writes, network connections, DexClassLoader usage, command execution, and camera access in real time.
- Network Traffic Inspection: Capture packets with tcpdump or mitmproxy to identify C2 beaconing, DGA domains, and data exfiltration patterns.
- Malware Classification: Map observed behaviors to categories such as banking trojan, spyware, ransomware, or cryptojacker.
- Use Case: During incident response, an analyst receives a suspicious APK from a user report, runs it through MobSF and Frida monitoring in an isolated emulator, and confirms it is a banking trojan intercepting SMS messages and beaconing to a C2 server.
Quick Start
Analyze the attached suspicious.apk for malicious behavior, including permission abuse, network communication, and runtime activity, then classify the malware type.
