Abstract:As the techniques for Android malware detection are progressing, malware also fights back through deploying advanced code encryption with the help of Android packers. An effective Android malware detection therefore must take the unpacking issue into consideration to prove the accuracy. Unfortunately, this issue is not easily addressed. Android packers often adopt multiple complex anti-analysis defenses and are evolving frequently. Current unpacking approaches are either based on manual efforts, which are slow and tedious, or based on coarse-grained memory dumping, which are susceptible to a variety of anti-monitoring defenses. This paper conducts a systematic study on existing Android malware which is packed. A thorough investigation on 37,688 Android malware samples is conducted to take statistics of how widespread are those samples protected by Android packers. The anti-analysis techniques of related commercial Android packers are also summarized. Then, we propose AppSpear, a generic and fine-grained system for automatically malware unpacking. Its core technique is a bytecode decrypting and Dalvik executable DEX reassembling method, which is able to recover any protected bytecode effectively without the knowledge of the packer. AppSpear directly instruments the Dalvik VM to collect the decrypted bytecode information from the Dalvik Data Struct DDS, and performs the unpacking by conducting a refined reassembling process to create a new DEX file. The unpacked app is then available for being analyzed by common program analysis tools or malware detection systems. Our experimental evaluation shows that AppSpear could sanitize mainstream Android packers and help detect more malicious behaviors. To the best of our knowledge, AppSpear is the first automatic and generic unpacking system for current commercial Android packers.

Precise system-wide concatic malware unpacking

Research of dynamic general unpacking methods for Windows malware

PackerGrind: An Adaptive Unpacking System for Android Apps.

Happer - Unpacking Android Apps via a Hardware-Assisted Approach.

Unpacking Techniques and Tools in Malware Analysis

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

AppSpear: Bytecode Decrypting and DEX Reassembling for Packed Android Malware

AppSpear: Automating the Hidden-Code Extraction and Reassembling of Packed Android Malware

Assessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems

Directed Hidden-Code Extractor for Environment-Sensitive Malwares

Integration of Ether Unpacker into Ragpicker for plugin-based Malware Analysis and Identification

Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware

A fine-grained classification approach for the packed malicious code

An Efficient Multi-Step Framework for Malware Packing Identification

UnSafengine64: A Safengine Unpacker for 64-Bit Windows Environments and Detailed Analysis Results on Safengine 2.4.0

MLxPack: Investigating the Effects of Packers on ML-based Malware Detection Systems Using Static and Dynamic Traits

Eliminate Evading Analysis Tricks In Malware Using Dynamic Slicing

Packer Identification Using Hidden Markov Model

A malware detection framework based on kolmogorov complexity

Dynamic Analysis of Malicious Code

Concolic Execution as a General Method of Determining Local Malware Signatures