MOBILE FORENSICS
Mobile malware analysis – technical investigation of malicious software on smartphones
Malware analysis is designed for cases where a suspicious app, file or connection has already been identified and needs to be understood in technical detail: what does the malware do, how long has it been active, where does it send data to, and how does it persist on the device?
ORIENTATION
Which service is right for you?
- •Mobile Threat & Malware Check – low-threshold safety check / initial inspection
- •Detecting spyware on smartphones – a targeted investigation where there are specific grounds for suspicion of surveillance
- •Mobile Malware Analysis – technical forensic analysis of malware (this page)
- •Malware Assessment Report – expert documentation and assessment for the courts, employers or insurance companies
Technical background
Technical background
On Android, suspicious APK files can be examined statically and – where appropriate – dynamically in a controlled environment – including permissions, code, signature certificates and embedded addresses. On iOS, access to app binaries is more restricted; the focus there is on system logs, network data and indicators.
Traces and data sources
Relevant evidence and data sources
- •Suspicious APKs: manifest, permissions, signing certificate, embedded domains/IP addresses
- •Persistence mechanisms and autostart
- •Network connections and Server contacted
- •YARA and IOC matches
Our approach
Here’s how we do it
- •Back up the device or the suspicious file using a hash value.
- •Static and – where appropriate – dynamic analysis in an isolated environment (manifest, permissions, code, embedded addresses; runtime behaviour, network activity, processes and persistence).
- •Comparison with public indicators and classification of the function.
- •Technical report.
Borders
Borders
- •Malware that is obfuscated or self-replicating cannot always be fully analysed.
- •A lack of network data limits what can be said about data outflow.
Result
Possible results
- •Description of the malware’s functionality
- •Duration of the activity, communication objectives
- •IOCs for further tests
TYPICAL QUESTIONS
When is this analysis required?
LIMITATIONS & CONCLUSION
What you should know
Not every unusual behaviour on a smartphone is caused by malware – many causes are technically insignificant. A reliable conclusion can only be reached after analysing the available technical evidence and known indicators; it is not possible to make a credible, blanket assessment without conducting an investigation. The scope and depth of the analysis depend on the device, the operating system and the specific terms of reference for the investigation – we make it clear what can and cannot actually be deduced from the findings.
CUSTOMER REVIEWS
What our customers say
4.8 out of 5 stars on Trustpilot · 61 reviews
“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”
idalein
Verified review on Trustpilot
“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”
Layla Pankratz
Verified review on Trustpilot
“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”
a woman from Cologne
Verified review on Trustpilot
Enquire now – free initial consultation
Do you have any questions? Please contact us for a free initial consultation.
RELATED TOPICS
You might also be interested in
FREQUENTLY ASKED QUESTIONS
Frequently Asked Questions
Click on a question to see the answer.