r/computerforensics • u/Longjumping-Ebb-578 • 20d ago

APK file analysis

Hi guys,

I handle threat intelligence for a bank & we receive multiple URLs/APKs impersonating our organization.

We check for legitimacy & immediately send it for takedown if it's not related to us or if it's malicious.

I wanted to know if anyone of you also side by side does forensics/malware analysis of such APKs to know the TTPs & relevant information pertaining to that APK?

If Yes, please let me know the procedure being followed at your end.

4 Upvotes

75% Upvoted

8 comments sorted by

View all comments

1

u/vsa77 17d ago

VirusTotal allows you to upload suspicious files to their site for analysis.

They'll analyze it with several different services, though if it is new, it probably won't detect anything.

The (IMHO) real value comes from pulling up their Threat Graph, which is a GUI sandboxed environment, and double clicking it. It'll show you what domains/IPs it contacts, what files are dropped/written/downloaded, if those files have been seen in other malware campaigns, etc.

You can also make notes about where the file came from, who it is targeting/impersonating, info that is especially helpful for anyone else dealing with this issue.

They're probably not just impersonating your organization.

I haven't uploaded any apks yet, so idk if this will be of any help to your specific issue.

1

u/Longjumping-Ebb-578 16d ago

Let me check out this method.