quark-engine v26.9.1
2026-9-5 14:33:49 Author: kitploit.com(查看原文) 阅读量:7 收藏

Black Hat Arsenal Black Hat Arsenal HITB defcon
build status codecov license python version PyPi Download
Twitter

Malware Family Analysis Report Showcase

FamilySummarySignature BehaviorsReport
DroidKungFuPrivilege escalation with C2 control.1. Gain unlimited access to a device.
2. Install/Uninstall additional apps.
3. Forward confidential data.		View
GoldDreamSMS/call log exfiltration with remote C2 commands.1. Monitor SMS messages and phone calls.
2. Upload SMS messages and phone calls to remote servers.		View
SpyNoteCredential theft and device surveillance via RAT.1. Take screenshots.
2. Simulate user gestures.
3. Log user input.
4. Communicate with C2 servers.		View
DawDropperDropper that installs banking trojans for financial theft.1. Download APKs from remote servers.
2. Install additional APKs.		View
SLockerAndroid ransomware locking/encrypting devices.1. Lock the device with an overlay screen.View
PhantomCardNFC relay–based financial fraud.1. Communicate with C2 servers.
2. Read the payment data of NFC cards.
3. Captures PINs of NFC cards through deceptive screens.		View
ToxicPandaBanking trojan enabling on-device fraud.1. Abuse Accessibility.
2. Remote device control.
3. Intercept OTP.		View
HydraBanking trojan using overlay attacks.1. Overlay credential theft.
2. Accessibility abuse.
3. Steal OTP/cookies.		View
SharkBotBanking trojan targeting financial credentials and transactions.1. Abuse Accessibility services.
2. Perform overlay attacks to steal credentials.
3. Intercept SMS messages (OTP).		View
AntidotBanking trojan disguised as legitimate updates for financial data theft.1. Intercept SMS messages (OTP).
2. Log user input (keylogging).
3. Enable remote control via C2.		View
ArsinkBanking trojan focusing on credential and financial data exfiltration.1. Steal sensitive data from device.
2. Intercept SMS messages (OTP).		View
TrickMoBanking trojan using overlay attacks and accessibility abuse for credential theft.1. Overlay attacks to steal banking credentials.
2. Intercept SMS for 2FA bypass.
3. Screen recording and accessibility abuse.
4. Dynamic payload loading via reflection.		View
AnubisBanking trojan with RAT capabilities.1. Overlay credential theft.
2. Keylogging.
3. Intercept SMS (OTP).
4. Remote control via C2.		View
GodFatherBanking trojan targeting financial credentials through overlay and accessibility abuse.1. Perform overlay attacks to steal credentials.
2. Abuse Accessibility services.
3. Intercept SMS messages (OTP).
4. Steal banking credentials and sensitive data.		View
TangleBotSMS-based Android malware stealing personal and financial data.1. Spread through SMS phishing links.
2. Control device interactions and overlay screens.
3. Access SMS, contacts, call logs, camera, and microphone.
4. Steal account and financial information.		View
BRATABanking trojan with remote control and anti-analysis capabilities.1. Perform overlay attacks to steal banking credentials.
2. Abuse Accessibility services for device control.
3. Intercept SMS messages (OTP).
4. Execute factory reset or device wipe commands.		View
CerberusBanking trojan targeting financial credentials through overlay and device control.1. Perform overlay attacks to steal credentials.
2. Abuse Accessibility services.
3. Log user input (keylogging).
4. Enable remote control via C2.		View
SuperCardXNFC relay malware enabling contactless payment fraud.1. Read NFC payment card data.
2. Relay NFC transactions to attacker-controlled devices.
3. Communicate with C2 servers.
4. Facilitate unauthorized contactless payments.		View
NGateNFC-based malware enabling relay attacks and payment fraud.1. Read NFC payment card data.
2. Relay NFC communications to attacker-controlled devices.
3. Communicate with C2 servers.
4. Facilitate unauthorized contactless payments.		View

Quick Start

Step 1. Install via PyPi

Install the latest version of Quark Engine:

$ pip3 install -U quark-engine

Step 2. Download Latest Rules

Fetch the latest rule database:

Step 3. Run Summary Report

Analyze an APK with the downloaded rules and generate a summary report:

Step 4. View Results

Example output: Screenshot-2025-11-25-22-36-54

Acknowledgments

The Honeynet Project

Honeynet.org logo

Google Summer Of Code

Quark-Engine has been participating in the GSoC under the Honeynet Project!

Stay tuned for the upcoming GSoC! Join the Honeynet Slack chat for more info.

Core Values of Quark Engine Team

  • We love battle fields. We embrace uncertainties. We challenge impossibles. We rethink everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others first.

Read more


文章来源: https://kitploit.com/en/posts/github-ev-flow-quark-engine-v2691
如有侵权请联系:admin#unsafe.sh