APK Forensics Tool

A modular static analysis pipeline designed to dissect Android applications, scan for over 30+ Indicators of Compromise (IOCs), map dangerous permissions, and flag potential Command & Control (C2) infrastructure.

⚠️ CRITICAL WARNING: The tracking sample 018f8548c055a31d98201874ebf21591e6d85cb9eee66e8c35716a9289d01f48.zip contains live Android malware. Do NOT download or extract without strict caution. The archive is currently password-protected for safety. Reach out to the repo admin for the decryption password.

---

Quick Start

1. Environment Setup

Clone the workspace and initialize an isolated Python environment:

# Clone the repo
git clone https://github.com/lumin3t/APK-Trus.git && cd APK-Trus

# Create and activate a virtual environment
python3 -m venv myenv
source myenv/bin/activate

2. Install Dependencies

Install the primary parsing engines required by the tool:

Bash

pip install -r requirements.txt

3. Execution Syntax

Analyze a target APK and save the forensic artifacts locally:

Bash

python3 main.py <target_file.apk> --json --html --out .

Note: If you have a local JADX-CLI installation to enhance obfuscation review, pass its path via the --jadx parameter:

Bash

python3 main.py malicious.apk --json --out . --jadx ./jadx_bin/bin/jadx

You can use the flag -h while executing main.py for help with the commands.

---

Project To-Do List

Phase 1: Code Refactoring & Architecture (Immediate)

• Modularize Structure: Break down the massive single-file implementation inside main.py into clean, maintainable directories:

Phase 2: Feature Enhancement & Reporting

• Generate JSON Report

• Generate HTML Report

• Generate ioc.txt File: Output a flat, digestible text file capturing isolated malicious network assets and matching file hashes for ingestion into SIEM tools.

• Enhance Metrics System: Integrate a non-linear Risk Percentage calculation metric alongside raw scoring numbers to reduce false-positive noise caused by benign developer kits.

Phase 3: External Intelligence & Scanning Upgrades

• VirusTotal API Integration: Append a lookup step to check the cryptographic hashes against the VirusTotal database before falling back to local inspection.

• YARA-like Rule Engine: Replace hardcoded RegEx lists with a flexible external signature parser (e.g., loading rules dynamically from compiled .yar or JSON configuration profiles).

Phase 4: Interface Extensions

• Refine CLI UX: Expand command line help menus using argparse choices, incorporating live shell progress tickers.

• Web Front-End Dashboard: Construct a minimal local web submission interface (e.g., leveraging a lightweight framework like Flask or FastAPI) to let users drop an APK and review results in a browser.