Android Smartphones play a vital role in our daily lives, as they help us stay connected and, not only that, they also help in performing several daily tasks like:
But, besides this, it also attracts the attention of cybercriminals or threat actors since smartphones hold our valuable and confidential data.
Cybersecurity researchers at Zimperium zLab recently identified an application package file (APK) dubbed “a.apk” that could be installed on the Android OS version above Android 9 Pie, but it can’t be scanned from most of the anti-decompilation tools.
THE EXPERTS DETECTED this APK sample (2f371969faf2dc239206e81d00c579ff) on a Tweet published by Joe Security.
Detected APK overview
While this sample prevents the decompilation by employing a decompression method that is entirely unsupported within its APK, a zip file makes the complete analysis difficult for many tools.
However, though it’s an old method, it’s sophisticated in nature and involves altering APK compression algorithms to evade the automatic script analysis so, that the static examination could be prevented.
With a 16-bit scope, 65,536 options exist, but Android’s APK, utilizing ZIP, accommodates just two compression methods.
Here below, we have mentioned those two compression methods:
Moreover, the unsupported compression methods in Android versions below 9 block installation, but it function properly in the case of the above Android 9 version.
Certain tools, like MacOS Archive Utility, fail to extract critical analysis files like “AndroidManifest.xml” from the APK. But, besides this, the JEB, in its latest release, has now fixed this flawed compression.
Here below we have mentioned all the techniques that the security analysts detect:-
Cybersecurity analysts at Zimperium zLabs discovered that to prevent the analysis, all the 3,300 samples were utilizing ‘unsupported unknown compression,’ they even found some too corrupted for the OS to load.
Out of these identified malicious samples, security analysts were able to find only 71 Android OS-loadable negative samples, and among these samples, none of them are available in Google Play Store at the moment.
Malicious apps using an unsupported unknown compression method:-
Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.
Best DNS Management Tools play a crucial role in efficiently managing domain names and their…
Customers can now easily integrate Sweet’s runtime detection and response platform into their AWS environments…
Cybercriminals exploit leaked credentials, obtained through various means, to compromise systems and data, enabling them…
SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases from…
In late October 2024, a coordinated IP spoofing attack targeted the Tor network, prompting abuse…
The Metasploit Framework, a widely used open-source penetration testing tool maintained by Rapid7, has introduced…