I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and xbin into one file for testing using Virustotal, after scanning, some anti-virus engines indeed detect the zip to have malware but I can't view the specific files that caused that detection. Is there a way to do this in virustotal? or any other way to achieve this?
2 Answers
An easy way would be for you to unzip the files in a VM, create md5 hashes and submit the hashes to virus total. You'd know which files are malicious then.
-
What is the purpose of extracting them in a virtual machine?, they are all ARM elfs and I am using a computer to analyze them Commented Sep 11, 2018 at 16:01
-
1You use a VM just because you are handling malware, similar to wearing gloves when handling dangerous material. The chance for an android virus working on your host os is so small, but better safe than sorry.– Joe MCommented Sep 11, 2018 at 16:03
-
-
There sure is: virustotal.com/en/documentation/public-api and a python package available via pip to use as well.– Joe MCommented Sep 11, 2018 at 16:25
Put the zip files in a virtual machine, unzip them there safely and submit them one by one for analysis, or use their script which will do this by querying the virustotal api.
answered Sep 11, 2018 at 15:48
-
What is the purpose of extracting them in a virtual machine?, they are all ARM elfs and I am using a computer to analyze them Commented Sep 11, 2018 at 16:01
-
You are about to handle infected files, it's not worth risking doing it to your native system. Plus, .elf are lunux executables and there are modern pc's with arm processors. Either way, do it as safe as possible. Commented Sep 11, 2018 at 16:15