OK so we're now in a situation where we have the suspicious APK available first let's rename the file 1
let's call this flipcortex.APK. OK. 2
Now we just have this file named 3
flipcortex.apk, actually let's also move this file. 4
Let's go to home and let's create a folder called Flipcortex let's move our APK to the newly created 5
folder 6
so all we did so far was just rename files and move them around. 7
We've not started the analysis yet. 8
So now we're in a folder called Flipcortex. 9
Now if you remember before we installed APKtool. Apktool is an extremely popular tool that is 10
used as a basis for many analysis tools let's run the command apktool d 11
Flipcortex.apk. 12
So basically this just starts decoding our apk 13
and you'll see that this creates a new folder called Flip cortex. 14
And so by running apktool d on the APK, apktool creates a folder with the Apps Smali code 15
inside. 16
Let's go to flipcortex and see what we find. 17
Here we see the android manifest which we had seen when we were developing the basic Android application. 18
Let's have a look nano Android manifest xml. We can already see a lot of information about this application. 19
We know that there's a service in the app with a receiver, a content provider and two activities. 20
Now remember in this case we saw the development of the app but this is not usually the case. 21
Usually we obtain apk and we have no idea about the code behind it. 22
So this is already a lot of information. 23
The normal user would not have knowledge of. So here there's a suspicious APK. 24
We don't have its source code but we're able to start obtaining information like the Android manifest 25
file which is an extremely useful file to understand what the application is doing. From here we can 26
also see that the application uses permissions: internet, read contacts and receive SMS so technically 27
here we can already start confirming some of our suspicions this app is a shopping list app but it seems 28
to be requesting SMS permission. 29
That doesn't really add up. 30
This isn't enough evidence though. 31
Who knows maybe the app uses SMS for some sort of two factor authentication. 32
So let's put that suspicion on hold for now. 33
So what else do we have in our decoded folder if you go to resources folder over here. 34
So say for example layouts folder here see these layouts you have the layouts which are the user interface 35
of the app we can see activity main XML which is the main layout associated with the main activity. 36
You can see the layout information inside. 37
So again always keep in mind that this is from an APK not from the source code. 38
So the fact that we can just get this from an app installed on your device is quite impressive. 39
Now let's go back to the manifest so let's have a look at the default activity here, we see the default 40
activity here is in the default main activity which is com dot flip cortex dot Hello World dot main 41
activity. So usually the manifest is a good location to get the starting point of an app. 42
Now let's go back to the folder and we can go to the smali directory and from here we follow the path 43
that we just saw in our manifest. CD com slash flip cortex slash hello world. 44
Here you should find main activity dot Smali which is the default activity of the suspicious application. 45
OK. 46
So here we're going to be presented with the smali code. 47
Now Smali it's not Java, Smali is human readable byte code. 48
You don't need to fully understand Smali but it will help to understand more or less what the app 49
does. In the following lessons will see how you can still understand the code without needing to fully 50
understand Smali but again by using only apk tool we already got a lot of information including 51
smali which would be able to tell us what the app does. 52
Step by step. OK. 53
So let's work out a small challenge, say our network security team tells us that they're noticing a lot 54
of data being sent to this URL: postman dash Echo Dot Com and you're tasked with investigating this 55
app to know if it's the source. 56
Now how can we try to determine if there's any code that we can identify related to this postman dash 57
Echo Dot Com. So if you are on a Linux machine you can run the grep command. 58
So running grep Dash r postman dash echo. 59
There you go. 60
So we already found something here. 61
So for example we can go into this code search for postman and here you see that in fact there is a 62
string with the U.R.L. we were warned about. 63
So there you go. 64
Here you would be able to almost confirm that yes this app is responsible for the data being sent to 65
postman dash Echo Dot Com.