This project focuses on Android exploitation using malware techniques and performing both static and dynamic malware analysis.
The objective is to simulate real-world cyber attack scenarios and analyze malicious APK behavior using digital forensics techniques.
- Exploit Android devices using Trojan-based malware
- Generate payloads using MSFVENOM
- Gain remote access and perform post-exploitation
- Perform static and dynamic malware analysis
- Identify malicious communication and indicators of compromise (IOCs)
- Kali Linux
- Metasploit Framework
- Android Emulator (Genymotion / NOX Player)
- MobSF (Mobile Security Framework)
- ADB (Android Debug Bridge)
- SpyNote (Android RAT)
- VirtualBox
- Configure Android Emulator
- Generate malicious APK using SpyNote
- Embed:
- IP Address
- Port Number
- Deploy payload via cloud sharing
- Execute APK on target device
- Establish reverse connection
- Access device files
- Monitor calls, messages, and contacts
- Capture microphone and camera data
- Retrieve device information (IMEI, GPS, etc.)
- Reverse engineering APK
- Manifest analysis
- Permission inspection
- Behavior monitoring
- Network traffic analysis
- C2 communication tracking
- MobSF
- APKiD
- Cerbero Profiler
- Suspicious permissions in APK
- Hardcoded C2 IP address
- Unusual network traffic
- Hidden application behavior
- Successfully established remote access using Android Trojan
- Identified malware family characteristics
- Extracted attacker IP and communication patterns
- Demonstrated risks of third-party APK installation
- Framework may not work on updated Android versions
- Security patches can break exploitation techniques
- Emulator-based testing differs from real devices
This project is for educational and research purposes only. Do not use these techniques on unauthorized systems.
Himani Asodariya