As a prerequisite for malware analysis for Android, we need PPK files, obviously, from where you
can get those files.
Well, there are two sources.
You have the Internet, which is full of repositories for known malicious applications such as GetUp!
We have some trusted Web sites like hybrid analysis or virus total.
And you can as well download HBK files directly from redistribution Web sites such as a B.K. Pure HBK
combo or HBK Mirror.
Supposedly the applications there are safe, but to be honest, I don't trust those Web sites.
If I want to download an application, I go directly to the Google store, the other source.
If you have an application that is already installed on your mobile, you want to check for possible
malware or malicious code.
You want to check for possible malicious code or data exfiltration that this application is performing.
You can install tools that will help you extract the application into an AP format.
Then you can download on your lab machine.
Some of these applications are PPK Extractor, E.S. File Explorer, Android and many others.
And this course will be in this course.
I'll be demonstrating this approach using Android.
So let's go check what's available there on the Internet in our Caleigh box.
Open Firefox and go to hybrid dash analysis dot com.
It's a trusted Web site that you need to sign in using your commercial or corporate email address.
After that, you'll be able to search for malware.
You can go to the file collection.
And then under the user here and go to advanced search here, we can specify the file type.
We're interested in Android applications.
Suppose that you want to search for reforged WhatsApp application.
So you just type what's up here?
And then just search.
Here we go.
You have list of four to what's up applications that you can install in an AP K format to use for your
analysis.
Some of the known repositories on gets Hub as this one here.
I'll be sharing the link in the course, different malicious Android applications that you can download
and start using.
This is another one that has recent for the year 2020.
And as you can see, they are all in zipped format.
Again, these malware are real and live.
If you scroll down, you will see the SHA hash for all of these applications.
Some of these applications have the M.D. five hash as well.
All of these zip files here are protected with a password which is infected.
Suppose that you want to test.
Let's see this malware application here.
Let's copy that.
And the five hash and go to a virus.
Total dot com virus.
Total is another Web site that you can search for.
You are El IP address domain or file hash.
So let's based our file hash here.
Initiate the search.
As you can see, the results here will tell you that 19 out of 62 anti malware engines detected this
file as malicious.
You can see all the details here of the venders, as well as the category of the as well as the category
of the malware.
It was detected as an AP case file.
18 days ago.
Sighs You can as well find.
More details on the harshing you can as well fine under the details tab, you will find more details
related to the hash, the history.
Permission is required by the applications, the activities, services, receivers, et cetera.
So, as you can see, a virus total is a very handy tool when it comes to malware.
Search.