4

I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and xbin into one file for testing using Virustotal, after scanning, some anti-virus engines indeed detect the zip to have malware but I can't view the specific files that caused that detection. Is there a way to do this in virustotal? or any other way to achieve this?

3

An easy way would be for you to unzip the files in a VM, create md5 hashes and submit the hashes to virus total. You'd know which files are malicious then.

  • What is the purpose of extracting them in a virtual machine?, they are all ARM elfs and I am using a computer to analyze them – AguThadeus Sep 11 '18 at 16:01
  • 1
    You use a VM just because you are handling malware, similar to wearing gloves when handling dangerous material. The chance for an android virus working on your host os is so small, but better safe than sorry. – Joe M Sep 11 '18 at 16:03
  • Ok thanks, is there an api for checking these hashes? – AguThadeus Sep 11 '18 at 16:06
  • There sure is: virustotal.com/en/documentation/public-api and a python package available via pip to use as well. – Joe M Sep 11 '18 at 16:25
1

Put the zip files in a virtual machine, unzip them there safely and submit them one by one for analysis, or use their script which will do this by querying the virustotal api.

  • What is the purpose of extracting them in a virtual machine?, they are all ARM elfs and I am using a computer to analyze them – AguThadeus Sep 11 '18 at 16:01
  • You are about to handle infected files, it's not worth risking doing it to your native system. Plus, .elf are lunux executables and there are modern pc's with arm processors. Either way, do it as safe as possible. – Chris Tsiakoulas Sep 11 '18 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.