image credit: pxhere
Called DroidMorph, the tool allows for the cloning of both malicious and benign applications by making modifications at different levels of abstraction. Testing against 17 commercial anti-malware engines has shown that half don’t detect the clones.
Implemented on top of the Soot Framework, the tool provides all of the necessary functionality for the generation of Android bytecode, as well as for modifying and analyzing it. The tool decompiles the APK, carries out the morphing, and then recompiles the modified code and signs the APK.
Comments are closed.
