Fingerprinting Android malware packaging process through static analysis to identify their creator

No ratings

Presented at hackfest 2017 by

François Gagnon

In this talk, we will look at some elements of Android malware static analysis: what interesting information can be extracted from an APK and what might allow to distinguish between malware and legitimate apps. Statistics from an effort to analyze >200,000 malware will be presented. This will help us understand the current situation and possible artefacts present in malware samples. Finaly (at most importantly), we’ll look at some strategies that allow us to cluster malware samples around their origin. That is, how can we tell that two samples are form the same creator, without knowing exactly who that creator is, by fingerprinting the malware packaging process. This project is the result of a collaboration between cybersecurity R&D lab at Cegep Sainte-Foy and the Canadian Cyber Incident Response Center (Public Safery CCIRC).