Description
This assignment is focused on the analysis of one Android application, which is flagged as being malicious. We want to know exactly what is the purpose, and how it works.
Consider the application has MALICIOUS. In order to analyze this application, NEVER install it in a real phone! and ALWAYS use an emulator!. Do not enter personal data.
The DeepSeek Application
The application was available at https[:]//deepseek[.]sbs, presenting as an interface for the recent DeepSeek-r1 model.
Consider this ZIP file contains the APK together with an additional file that is part of the attack chain. It is included because the original location may become offline at any moment. Start with the main APK and analyze it. If some file is not available, check if it is in the ZIP.
The following aspects should be covered:
- characterization of the main logic blocks/processes/activities of the application, with focus on the ones responsible for malicious behavior
- characterization of the APIs, communication methods, and message structure used for malicious purpose
- analysis of further payloads
- identification of potential issues and impact to users
The output should be composed of a report and a series of files, code snippets and related documentation supporting the report. If the students allow it, the reports will be made available in a public github repository. For this purpose, it is advised to use Markdown. We wish that with your knowledge we can help others that were victim of this malware.
In the end, someone reading the report should have information about the overall structure of the application, how the main malicious functionalities are implemented, what is the impact to users and to an organization, which indicators of compromise can be used (IP addresses, file hashes, domains), and what is the general operation of the attack.
Please follow this structure:
- Executive summary
- Backgroud
- Static analysis
- Behavioral Analysis
- Code Analysis
- Analysis Summary.
For an example, check this resource
Rules
The use of automated tools to scan the application is accepted. However, grading will be focused in your work, your strategy, and your analysis, not on the raw results. Describe the processes followed, the suspicious you may have, and your conslusions the tools you used and justify it.
This project is expected to be authored by the students enrolled in the course. The use of existing code snippets, applications, or any other external functional element without proper acknowledgement is strictly forbidden. If any content lacking proper acknowledgment is found in other sources, the current rules regarding plagiarism will be followed.
References and tools
- Frida: https://frida.re/
- APKTool: https://ibotpeaches.github.io/Apktool/
- Android Studio: https://developer.android.com/studio
- Dex2Jar: https://github.com/pxb1988/dex2jar
- JD-Gui: https://github.com/java-decompiler/jd-gui
- OWASP ZAP: https://www.zaproxy.org/