Manipulating Malware: Forcing Android Malware to Self-Unpack

Discover an innovative approach to Android malware analysis in this 31-minute conference talk from Recon 2024, where Laurie Kirk presents a groundbreaking technique for forcing packed Android malware to reveal its hidden payloads. Learn about an automated, platform-independent method that leverages the malware's own code against itself, eliminating the need for custom decryptors while remaining packer-agnostic. Follow the detailed process of extracting and translating Dalvik Bytecode, resources, and native code from malicious stubs into self-unpacking entities, with two possible output formats: pure Java applications that bypass Android emulator requirements or defanged versions of the original APKs. Get introduced to BadUnboxing, an open-source tool that automatically generates benign versions of Android malware to expose malicious payloads, along with methodologies for repackaging defanged APKs. Presented by Laurie Kirk, a Reverse Engineer specializing in cross-platform malware analysis with a focus on mobile threats, who runs the YouTube channel @LaurieWired and has spoken at numerous security conferences including DEFCON, TROOPERS23, and BlueHat.