JADX-GUI: Dex to Java decompiler
| Finding | Severity | How to Detect |
|---|---|---|
| Excessive permissions | High | Check AndroidManifest.xml for dangerous perms |
| Accessibility service abuse | Critical | Look for BIND_ACCESSIBILITY_SERVICE + service in manifest |
| Device admin usage | Critical | Check for DEVICE_ADMIN_ENABLED receiver |
| Obfuscated package/class names | High | Random strings in package/classes (jadx) |
| Hardcoded URLs / IPs | Critical | strings / grep / jadx search |
| Dynamic code loading | Critical | Look for DexClassLoader, loadDex |
| SMS / Call / Contacts access | High | Permissions + API usage in code |
| Boot persistence | High | RECEIVE_BOOT_COMPLETED + BroadcastReceiver |
| Overlay / screen capture | Critical | SYSTEM_ALERT_WINDOW, MediaProjection APIs |
Suspicious Patterns:
- Random package names (
com.asd.qwe.zxc) - Large permission set (SMS, mic, contacts, location)
- Accessibility + Device Admin combo
RECEIVE_BOOT_COMPLETEDSYSTEM_ALERT_WINDOWREQUEST_INSTALL_PACKAGES- Obfuscated class names
- Embedded
.dex/.so - Base64 / encrypted blobs
- Fake app labels/icons
Identify
file sample.apk
Enumerate
unzip -l sample.apk
Look for:
AndroidManifest.xmlclasses.dexassets/lib/
Extract Safely
7z x sample.apk -oapk_out
Decode
apktool d sample.apk
jadx -d jadx_out sample.apk
Manifest Analysis
cat apk_out/AndroidManifest.xml
Check:
| Artifact | What to Look For |
|---|---|
| Permissions | Dangerous perms (READ_SMS, RECORD_AUDIO) |
| Services | Background services |
| Receivers | Boot persistence |
| Accessibility | BIND_ACCESSIBILITY_SERVICE |
| Device Admin | DEVICE_ADMIN_ENABLED |
Hunt
strings sample.apk | grep -Ei "http|https|tcp|udp"
grep -R "http" jadx_out/
grep -R "base64" jadx_out/
Code Analysis (jadx)
Look for:
| Pattern | Indicator |
|---|---|
| Networking | HttpURLConnection, OkHttp |
| C2 | Hardcoded domains/IPs |
| Obfuscation | meaningless variable names |
| Dynamic loading | DexClassLoader |
| Commands | Runtime.exec() |
Persistence
| Method | Detection |
|---|---|
| Boot receiver | RECEIVE_BOOT_COMPLETED |
| Accessibility | service declared |
| JobScheduler | JobService |
| AlarmManager | scheduled tasks |
Storage
| Location | Use |
|---|---|
/data/data/<pkg>/ | internal storage (configs, DBs) |
/data/media/0/Android/data/<pkg>/ | external storage |
/sdcard/ | payload staging |
Summary
APK = ZIP + DEX
Analyze:
- Manifest (permissions + components)
- Code (jadx)
- Strings (C2, payloads)
- Storage (files, DBs)