Analysis of an Android Remote Access Trojan (RAT)

Submission Probe

One instruction sends the sample in. AVL Code does not run a sandbox first — VT is disabled, so it goes straight to file-format probing plus pure static analysis:

Help me analyze a94f85b04bafce6a961d989f46f481e8 and produce a complete analysis report covering basic information, malicious harm, main malicious behaviors, IOCs and more

VT disabled → switches to file-format probing + static analysis
→ File header: PK — ZIP/APK
→ Structure: an Android APK built on the Material Design 3 component library
→ Overall entropy 7.72 · 99% of printable strings are random garbage
→ Verdict: a heavily packed/obfuscated commercial-grade APK; the normal unpacking route is expected to fail

Unpacking and Degradation

The entropy verdict already predicted unpacking would fail, but the route has to be walked to count. Within the same instruction AVL Code tries and fails in a chain:

Help me analyze a94f85b04bafce6a961d989f46f481e8 …… (the same instruction still running, no new input)

Unpacking attempts in a chain: Python → PowerShell → 7z all fail; plaintext Manifest not obtained
→ Falls back to built-in capability: repeated targeted sec.strings extraction of readable strings
→ Key strings surface: huawei,hinova,tianyi — brand-targeted detection
→ Followed to xiaomi,mi,redmi and the activity_* family of suspicious component names

Resource Forensics

With the direction fixed, string extraction becomes search-by-map, and the resource directory names that survived the packer hand over the malicious capabilities one by one:

…… a complete analysis covering basic information, malicious harm, main malicious behaviors, IOCs and more

sec.strings keeps extracting, and component/resource evidence chains up
→ Fake lock screen / screen recording / camera capture / phishing pages / authorization-bait activities
→ Three overlay windows · accessibility-abuse configs · privacy-bypass routes
→ Brand icons: Huawei / Xiaomi / OPPO / vivo / Samsung
→ Final pass hunts URLs and network strings: no network IOCs inside the packer

Verdict and Delivery

The evidence chain closes; AVL Code archives every finding and integrates them into a report you can take straight into a ticket:

…… produce a complete analysis report

memory.memorize archives all findings → integrates them into the full analysis report
→ Verdict: Android remote-access trojan (RAT) / banking trojan · threat level Critical
→ Attack chain (inferred): accessibility authorization bait → background listening/auto-clicking → overlay + fake lock screen → camera capture/recording → data exfiltration
→ IOCs: 3 file hashes + component paths + string traits · 1 YARA rule (fires on 5 of 10 traits)
→ Five remediation steps: hash blocklist / unpack and deep-reverse / monitor accessibility permissions / official channels only / audit installed devices

Try it yourself

Reproducing this case takes one instruction: import the sample (named by MD5) into the workspace and paste the following, or import the session to replay the full process:

› Help me analyze <sample MD5> and produce a complete analysis report covering basic information, malicious harm, main malicious behaviors, IOCs and more

• VT disabled, read-only sample sandbox and no unpacking — none of these three constraints breaks the main flow: AVL Code automatically degrades to string/resource forensics when unpacking fails; on replay, whether unpacking tools are available only changes the intermediate path, not the final deliverable. If your threat-intel channel is available, you can add a lane of online corroboration. The session export is the summary variant (tool calls folded into counts); component and resource details live in the report.pdf published with the case.

Next question: The report lists "extract the original DEX from the packer for deep reversing" as remediation step 2 — the natural next task is obtaining the unpacked DEX, recovering C2 communication and the exfiltration channel, and upgrading these string traits into network-layer IOCs.