Case study · Sample Analysis
Multi-Agent Parallel Analysis of an Android Banking Trojan
A mobile security analyst receives an Android installer disguised as a legitimate app and needs a fast verdict without executing the sample. One instruction, three parallel sub-agents, and about 95 seconds later he holds a complete analysis report with an IOC list and YARA rules.
Target: an 11.9 MB malicious APK (pure static, never executed)· Model: Landi N2.5 (provided by AVL-Zero)· Duration: about 95 seconds (multi-agent parallel)· Deliverable: full analysis report · IOCs · YARA rules
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model
Overview
- 01
Submit and triage — hashes, structure and entropy analyzed purely statically
Hand AVL Code the sample filename and report requirements in one pass, and you will see it confirm the sample exists, compute MD5/SHA256, parse the APK structure, and report an overall entropy of 7.92.
- 02
String archaeology — layout filenames name 12 payment brands outright
The first 200 strings are only resource paths; you will see it widen the extraction and focus on AndroidManifest, permissions, class names and URLs, until activity_record_pay_*.xml phishing screens surface in droves.
- 03
Multi-agent parallelism — three sub-agents crack the obfuscated, encrypted content
When large amounts of obfuscated/encrypted content show up in the strings, the main agent splits off three sub-agents to analyze in parallel, then integrates all findings.
- 04
Verdict and delivery — a Critical-rated banking-trojan report lands on disk
The integrated full report is written to malware_analysis_report.md: attack chain, IOC list and YARA rules, threat level Critical.
Task for AVL Code
Help me analyze this Android trojan, net.queue.verifierx.transmitter.apk, and produce a complete analysis report covering basic information, malicious harm, main malicious behaviors, IOCs and morePrerequisites: An AVL Code environment + the APK sample file to be judged. Purely static analysis throughout — no real device or emulator needed to run the sample
Reproduction materials at the end of this article Try it yourself ↓
Multi-Agent Parallel Analysis and Delivery
One instruction submits the sample; from verdict to report on disk everything is driven autonomously by AVL Code:
Help me analyze this Android trojan, net.queue.verifierx.transmitter.apk, and produce a complete analysis report covering basic information, malicious harm, main malicious behaviors, IOCs and moreConfirms the sample exists (11.9 MB) → MD5/SHA256 · APK structure parsing · overall entropy 7.92
→ The first 200 strings are only resource paths → widens extraction to AndroidManifest, permissions, class names and URLs
→ activity_record_pay_*.xml phishing screens surface in droves (14+ bank/payment targets)
→ Heavy obfuscation/encryption appears → splits 3 sub-agents to crack it in parallel
→ Integrated report lands as malware_analysis_report.md: attack chain + IOC list + YARA rules · threat level CriticalTry it yourself
All you need is an APK to be judged and AVL Code: verify the hash, send one instruction, and wait for the report to land.
Step 1 · Submission: put the suspicious APK into the workspace and verify the sample hashes MD5: 18827998ad05c58da1d218066374fe16 SHA256: c692ad120cc90548d48dbe57d006f2403c49833b8993af3c38fe031eb39999bdStep 2 · One-round instruction: Help me analyze this Android trojan, <sample filename>.apk, and produce a complete analysis report covering basic information, malicious harm, main malicious behaviors, IOCs and moreStep 3 · Deliverable: <report filename>.md (sample overview / core malicious behaviors / IOC list / YARA rules / attack chain / protection advice)- This session is a single-round task: from submission to report on disk there is only one user message, and everything after is driven autonomously by AVL Code, so only the first chapter carries a conversation panel. "About 95 seconds" comes from the case library’s existing data; the session export’s message timestamps are all identical, so it cannot be re-verified from the session. The breakdown of the three sub-agents and the MITRE mapping do not appear in the readable export; no speculation beyond the evidence is made.
Next question: The verdict is only an intermediate product — the natural next step is deploying these YARA rules onto the detection line and batch-scanning same-family variants to verify the detection rate and false positives.