Project 1 - Android Reversing

Description

This assignment is focused on the analysis of one Android application, which is flagged as being malicious. We want to know exactly what is the purpose, and how it works.

Consider the application as being MALICIOUS. In order to analyze this application, NEVER install it in a real phone! and ALWAYS use an emulator!. Erase the emulator after execution. Do not enter personal data.

The Application

The application, found here consists of a sample reported by users as a System Optimizer application. These applications are typically compromised as they naturally require a relevant number of permissions.

The following aspects should be covered:

  • characterization of the main logic blocks/processes/activities of the application, with focus on the ones responsible for malicious behavior
  • characterization of the APIs, communication methods, and message structure used for malicious purpose
  • analysis of further payloads
  • identification of potential issues and impact to users

The output should be composed of a report and a series of files, code snippets and related documentation supporting the report. If the students allow it, the reports will be made available in a public github repository. For this purpose, it is advised to use Markdown. We wish that with your knowledge we can help others that were victim of this malware.

In the end, someone reading the report should have information about the overall structure of the application, how the main malicious functionalities are implemented, what is the impact to users and to an organization, which indicators of compromise can be used (IP addresses, file hashes, domains), and what is the general operation of the attack.

Please follow this structure:

  • Executive summary: A summary for management roles, non technical
  • Background: Context of the file, and purpose from OSINT
  • Overall Behavioral Analysis: High level operation of the application and its most relevant features
  • Static analysis: Analysis of file structure and content
  • Code Analysis: Analysis of the code structures, main logic block and operation
  • Dynamic Analysis: Analysis of the dynamic operation of the application, pinpointing what it does, and the existing communication endpoints (if possible)
  • Indicators or Compromise: Artifacts such as IP addresses, file hashes, domain names that can be used to detect the application

For an example, check this resource

Rules

The use of automated tools to scan the application is accepted. However, grading will be focused in your work, your strategy, and your analysis, not on the raw results. It is vital that you describe the processes followed, the suspicious you may have had, the tools you used, and your conclusions.

This project is expected to be authored by the students enrolled in the course. The use of existing code snippets, applications, or any other external functional element without proper acknowledgement is strictly forbidden. If any content lacking proper acknowledgment is found in other sources, the current rules regarding plagiarism will be followed.

References and tools

Previous
Next

Last updated on 12 Feb 2026