Android 恶意软件跟踪器
这原本是我一直在开发的框架中的一个模块。解码器主要利用 Androguard 来提取 C2 或恶意软件作者的凭据。
其中一个解码器使用 LIEF 从 Android 恶意软件样本中提取 C2。
我还有一些配置提取器尚未添加。如果你有希望我添加的特定 Android 家族，请告诉我。在我发布此仓库后，这些代码将需要更新。
因为恶意软件作者可能会修改他们的代码，以防止此工具提取有用信息。
目前，我已为以下家族添加了配置提取器：
$ python.exe .\amtracker\amtracker.py -f d4e16801c46f51f704ed439fe7648e9d93a2b8f571d7120657f64190f6028b23
______ __ __ __ ______ ______ ______ ______ ______ __ __ ______ __ __
/\ ___\ /\ \_\ \ /\ \ /\__ _\ /\ ___\ /\ == \ /\ == \ /\ __ \ /\ \/ / /\ ___\ /\ "-.\ \
\ \___ \ \ \ __ \ \ \ \ \/_/\ \/ \ \___ \ \ \ __< \ \ __< \ \ \/\ \ \ \ _"-. \ \ __\ \ \ \-. \
\/\_____\ \ \_\ \_\ \ \_\ \ \_\ \/\_____\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\\"\_\
\/_____/ \/_/\/_/ \/_/ \/_/ \/_____/ \/_____/ \/_/ /_/ \/_____/ \/_/\/_/ \/_____/ \/_/ \/_/
Extract intel from this Android mallie!
Jacob Soo
Copyright (c) 2018-2022
[+] Verifying if it's AhMyth.
[+] Extracting from d4e16801c46f51f704ed439fe7648e9d93a2b8f571d7120657f64190f6028b23
[+] C&C: [ http://217.11.29.164:44303 ]
$ python.exe .\amtracker\amtracker.py -f 26ffbf3d4820572e10c8f0d7c4549f622152e16f1818a1a0417724b1fb8b94d2
______ __ __ __ ______ ______ ______ ______ ______ __ __ ______ __ __
/\ ___\ /\ \_\ \ /\ \ /\__ _\ /\ ___\ /\ == \ /\ == \ /\ __ \ /\ \/ / /\ ___\ /\ "-.\ \
\ \___ \ \ \ __ \ \ \ \ \/_/\ \/ \ \___ \ \ \ __< \ \ __< \ \ \/\ \ \ \ _"-. \ \ __\ \ \ \-. \
\/\_____\ \ \_\ \_\ \ \_\ \ \_\ \/\_____\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\\"\_\
\/_____/ \/_/\/_/ \/_/ \/_/ \/_____/ \/_____/ \/_/ /_/ \/_____/ \/_/\/_/ \/_____/ \/_/ \/_/
Extract intel from this Android mallie!
Jacob Soo
Copyright (c) 2018-2022
[+] Verifying if it's AndroRat.
[+] Extracting from 26ffbf3d4820572e10c8f0d7c4549f622152e16f1818a1a0417724b1fb8b94d2
[+] C&C: [ mehyaz.ddns.net:81 ]
$ python.exe .\amtracker\amtracker.py -f ca87cc9898af3883eca81aca658109fdd7ca2529dfbd45a25e0c6e7cf0b526e5
______ __ __ __ ______ ______ ______ ______ ______ __ __ ______ __ __
/\ ___\ /\ \_\ \ /\ \ /\__ _\ /\ ___\ /\ == \ /\ == \ /\ __ \ /\ \/ / /\ ___\ /\ "-.\ \
\ \___ \ \ \ __ \ \ \ \ \/_/\ \/ \ \___ \ \ \ __< \ \ __< \ \ \/\ \ \ \ _"-. \ \ __\ \ \ \-. \
\/\_____\ \ \_\ \_\ \ \_\ \ \_\ \/\_____\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\\"\_\
\/_____/ \/_/\/_/ \/_/ \/_/ \/_____/ \/_____/ \/_/ /_/ \/_____/ \/_/\/_/ \/_____/ \/_/ \/_/
Extract intel from this Android mallie!
Jacob Soo
Copyright (c) 2018-2022
[+] Verifying if it's APT-C-23.
[+] It's APT-C-23
[+] Extracting from ca87cc9898af3883eca81aca658109fdd7ca2529dfbd45a25e0c6e7cf0b526e5
[+] Extracted C2: http://upload101.net/android/domains
[+] Extracted C2: http://upload999.info
APT-C-27
BankBot
$ python.exe .\amtracker\amtracker.py -f 2a4cf22220b95ad1f802efd1ae8abea56e83dc598d66eb073d75882d20858e39
______ __ __ __ ______ ______ ______ ______ ______ __ __ ______ __ __
/\ ___\ /\ \_\ \ /\ \ /\__ _\ /\ ___\ /\ == \ /\ == \ /\ __ \ /\ \/ / /\ ___\ /\ "-.\ \
\ \___ \ \ \ __ \ \ \ \ \/_/\ \/ \ \___ \ \ \ __< \ \ __< \ \ \/\ \ \ \ _"-. \ \ __\ \ \ \-. \
\/\_____\ \ \_\ \_\ \ \_\ \ \_\ \/\_____\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\\"\_\
\/_____/ \/_/\/_/ \/_/ \/_/ \/_____/ \/_____/ \/_/ /_/ \/_____/ \/_/\/_/ \/_____/ \/_/ \/_/
Extract intel from this Android mallie!
Jacob Soo
Copyright (c) 2018-2022
[+] Verifying if it's BladeHawk.
[+] Potentially BladeHawk
[+] Extracting from 2a4cf22220b95ad1f802efd1ae8abea56e83dc598d66eb073d75882d20858e39
[+] C&C: [ alex00.ddns.net ]
[+] Port : [ 4000 ]
$ python.exe .\amtracker\amtracker.py -f "C:\Users\admin\Desktop\Android malware\CapraRAT\d62705186c488bb26fccdb1404931223a887004fd6704ac1483e599a15e92792"
______ __ __ __ ______ ______ ______ ______ ______ __ __ ______ __ __
/\ ___\ /\ \_\ \ /\ \ /\__ _\ /\ ___\ /\ == \ /\ == \ /\ __ \ /\ \/ / /\ ___\ /\ "-.\ \
\ \___ \ \ \ __ \ \ \ \ \/_/\ \/ \ \___ \ \ \ __< \ \ __< \ \ \/\ \ \ \ _"-. \ \ __\ \ \ \-. \
\/\_____\ \ \_\ \_\ \ \_\ \ \_\ \/\_____\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\\"\_\
\/_____/ \/_/\/_/ \/_/ \/_/ \/_____/ \/_____/ \/_/ /_/ \/_____/ \/_/\/_/ \/_____/ \/_/ \/_/
Extract intel from this Android mallie!
Jacob Soo
Copyright (c) 2018-2022
[+] Verifying if it's CapraRAT.
[+] It's CapraRAT
[+] Extracting from C:\Users\admin\Desktop\Android malware\CapraRAT\d62705186c488bb26fccdb1404931223a887004fd6704ac1483e599a15e92792
[+] C2 : [ 80.241.209.53 ]
[+] C2 : [ shareboxs.net ]
[+] Ports : [ 12182 ]
$ python.exe .\amtracker\amtracker.py -f 65c655663b9bd756864591a605ab935e52e5295735cb8d31d16e1a6bc2c19c28.apk
______ __ __ __ ______ ______ ______ ______ ______ __ __ ______ __ __
/\ ___\ /\ \_\ \ /\ \ /\__ _\ /\ ___\ /\ == \ /\ == \ /\ __ \ /\ \/ / /\ ___\ /\ "-.\ \
\ \___ \ \ \ __ \ \ \ \ \/_/\ \/ \ \___ \ \ \ __< \ \ __< \ \ \/\ \ \ \ _"-. \ \ __\ \ \ \-. \
\/\_____\ \ \_\ \_\ \ \_\ \ \_\ \/\_____\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\ \_\ \ \_____\ \ \_\\"\_\
\/_____/ \/_/\/_/ \/_/ \/_/ \/_____/ \/_____/ \/_/ /_/ \/_____/ \/_/\/_/ \/_____/ \/_/ \/_/
Extract intel from this Android mallie!
Jacob Soo
Copyright (c) 2018-2022
[+] Verifying if it's Xenomorph.
Requested API level 31 is larger than maximum we have, returning API level 28 instead.
Requested API level 31 is larger than maximum we have, returning API level 28 instead.
[+] It's Xenomorph
[+] Extracting from 65c655663b9bd756864591a605ab935e52e5295735cb8d31d16e1a6bc2c19c28.apk
[+] C&C : [ datasciensonline.us ]
[+] C&C : [ gogoanalytics.click ]
[+] C&C : [ gogoanalytics.digital ]
[+] C&C : [ sallaka.com ]
[+] C&C : [ mybizzl.com ]
python amtracker.py [-f|-d] <filename>