There are two common approaches to counter forensic investigation, often allegedly malicious mobile
application.
That is the static analysis and the dynamic analysis.
The static analysis consists of viewing the APC a file without inspecting the actual instructions.
This type of analysis can verify whether the data is malicious, present information about its functionality,
and sometime give information allowing us to create some uncomplicated network signature.
However, this kind of analysis is not effective against complex meller as it can skip some of its behavior
elsewhere.
Dynamic analysis.
The main methods include launching the APC a file or launching the application and monitoring its behavior
in the system to remove the infection.
However, before running the malware safety, you must make sure to run it in a lab environment to minimize
the harmful effect.
You can use the techniques of dynamic analysis without having an in-depth programming knowledge such
as Java.
But again, this kind of technique is not useful for all the malicious program as it can skip some functionality.
So the best way is to combine static and dynamic analysis techniques to how does these application reach
the end user simply through different distribution mechanism.
The simplest one is Appstore distribution and where the Trojans are uploaded to the absolute and large
number to take advantage of the download volume.
The Trojan is disguised in a free tool which supposedly will have legitimate application purposes.
Another approach is to use phishing enabled distribution.
It's a popular method for coercing users into installing malicious applications is another approach
is to use phishing, enable distributions.
A popular method for coercing users to install malicious applications is to send them links to HBK files
posted on the attacker Web site.
Normally this happens over s.m as or email spam messages.
A third approach is to distribute via compromised website.
The dissemination of mobile malware may be facilitated through the compromise of a legitimate website
that is then used to host malicious applications.
Distribution via operating system images is an alternative to App Store deployment in where the Trojan
application is included within the custom operating system images.
So on the US platform itself, natively, so on platforms that allow device manufacturers to load their
own or as version images at the point of distribution.
There is a risk that Chozen application may be included as part of the standard distribution compromised.
So scalds.
So legitimate applications can also be romanized by a malicious actor without the knowledge of the original
developers.
So an attacker might compromise source code, do a malicious change and then upload the application.
At the end of the day, the users will install such applications that supposedly will facilitate their
compromised source code happen when legitimate applications are traumatized by malicious actors without
the knowledge of the original developer.
The source code is then changed compiled and the APC is uploaded to many platforms.
While the distribution of frozen applications is the most common form of deployment mechanisms for mobile
malware.
There are some circumstances where a malicious actor may develop exploits for typical software installed
on target devices and use them to install their payloads without user interaction.
So an attacker might exploit a vulnerability in an application to be able to silently install a malware
on the mobile phone of the user.
And last but not least, it's the loss of physical control and where most of the deployment mechanisms
we just describe involve compromise that occurs while the device is in the hands of the user.
However, there may be situations where a malicious actor seeks to leverage a period of time when the
device is not in the possession of the user.
Scenarios such as monitoring software installed by authorities during a border transit or device left.
Unattended, for example, in an Ortel or in a public place.