Unmasking Mobile Threats: MobSF

Mobile Security Framework (MobSF) is an open-source automated security testing framework for mobile applications (Android/iOS/Windows) that can perform static, dynamic, and API security analysis.

Key Components:

1. Static Analysis: Examines code without executing it.
2. Dynamic Analysis: Tests app behavior during runtime.
3. API Testing: Checks backend API security.
4. Malware Analysis: Detects malicious patterns.

While MobSF can analyze both apk and ipa but it outperforms in apk analysis.

An APK (Android Package Kit) is the file format used to distribute and install apps on Android. Think of it like a .exe file for Windows, but for Android apps. IPA being iOS App Store Package.

Here, we are gonna analyze a sample of malware on our local host, Les go

Start by upating your unix distro

Next, Install docker if you already don’t have…

Pull the docker image of MobSF: sudo docker pull opensecurity/mobile-security-framework-mobsf:latest

After, It’s completed

Run it using: sudo docker run -it — rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

It’s running on below link, local host , Follow it using firefox.

First we get this login page, Add creds as mobsf:mobsf

Now, we can upload any malware apk file and analyze it efficiently.

For Dynamic analysis, we need an emulator. So, I downloaded the emulator.

After extracting the genymotion, we get a new folder of genymotion with alot of files as seen below.

Now, we run the geny motion emulator.

Next, we get a login screen, Enter your creds if not already made then create it.

After account creation and all agreements

We get this interface

I will keep the display as it is

The image is being created

It was defaulted to QEMU hypervisor, I got errors on that.

Second option was virtual box so i used that instead…

Now, we’ve got our emulator ready!