Add Quark malware analysis report for Skygofree

[pulorsok]

Adds a Quark analysis report for the Skygofree malware family to docs/source/malware_report.rst.

Quark flagged 2 of 2 samples as high-risk (detection rate 100%) and surfaced 4 of the 8 MITRE techniques documented for S0327 Skygofree. Every representative method lives in attacker-authored code (Lcom/sysmanager/, Lcore/syncsystem/) — no library mis-attribution.

This run did not add a new rule. The auto-picked candidate (getActiveNetworkInfo + isConnected) trained to -1.03, so it was dropped. Retrained weights for the existing pool go to quark-rules#87.

---

Skygofree Malware Family Analysis Report

This report analyses the Skygofree malware family using Quark's rule classification. Skygofree is a multi-stage Android surveillance implant documented by Kaspersky in 2018 and attributed to an Italian IT company selling offensive software. It is delivered through fake mobile-operator pages and, once installed, records audio and video on command, steals files from messaging applications, and downloads further modules from its command and control server. This run did not generate a new rule for Skygofree: the family's surveillance primitives are already covered by Quark's existing rule set. Check here for the rule set details.

Quark's rule classification flagged 2 of 2 Skygofree samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0327 Skygofree software entry. Of the 8 techniques documented for the family, Quark's static bytecode analysis surfaces the 4 listed below; see the coverage-gap notes at the end of this section for why the other 4 are not demonstrated here.

MITRE Technique	Real-world manifestation
T1429 Audio Capture	Recording ambient audio and phone calls when device enters specific locations
T1409 Stored Application Data	Stealing message databases and files belonging to other installed applications
T1407 Download New Code at Runtime	Fetching additional surveillance modules from command and control infrastructure on demand
T1512 Video Capture	Recording video through device cameras triggered by attacker commands or conditions

All behavior maps below were rendered from sample e6aba7629608a525b020f4e76e4694d6d478dd9561d934813004b6903d66e44c.apk (package com.sysmanager) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Skygofree. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1429 Audio Capture — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

startRecording directly initializes the recorder and starts recording audio. This call enables the service to capture ambient sound from the device microphone.

Behaviors detected by Quark:

• Initialize the recorder and start recording (Clean Up the Direct Use of MethodAnalysis (Sourcery refactored) #198)

2. T1409 Stored Application Data

T1409 Stored Application Data — attack.mitre.org

MITRE definition (T1409): Adversaries may try to access and collect application data resident on the device.

run calls one helper to read files into streams, retrieve absolute paths, and package file data into JSON objects. Together, these calls enable the malware to access application data files and prepare them for upload.

Behaviors detected by Quark:

• Read file and put it into a stream (Do we still need target.ag? #13)
• Read file into a stream and put it into a JSON object (Complete the test program and prepare releasing stable v19.11 #14)
• Get absolute path of the file and store in string (prevent some functions from looking for themselves #20)
• Open a file from given absolute path of the file ([Hotfix] prevent some functions from looking for themselves #22)

3. T1407 Download New Code at Runtime

T1407 Download New Code at Runtime — attack.mitre.org

MITRE definition (T1407): Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores.

doInBackground calls one helper to write HTTP input streams to disk and install APKs from those files. Together, these calls enable the malware to download and install additional applications at runtime.

Behaviors detected by Quark:

• Install other APKs from file (Make empty list comparisons more Pythonic, fixes #53 #54)
• Write HTTP input stream into a file (release v20.08 #72)

4. T1512 Video Capture

T1512 Video Capture — attack.mitre.org

MITRE definition (T1512): An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with the device cameras through an available API provided by the operating system.

takePic directly configures camera parameters, sets the preview texture, and starts capturing preview frames to the screen. Together, these calls enable the malware to activate the camera and capture visual data.

Behaviors detected by Quark:

• Get current camera paremeters and change the setting. (Refactor the core modules to make the code easier to read. #183)
• Set camera preview texture (Refactor the core modules to make the code easier to read. (Sourcery refactored) #184)
• Start capturing camera preview frames to the screen (Refactor/enrich the tests of the analysis part of modules (Sourcery refactored) #185)

Coverage-gap notes

The 4 MITRE techniques documented for Skygofree that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:

The evidence Quark collected does not demonstrate the technique (2) — T1404 Exploitation for Privilege Escalation and T1644 Out of Band Data.

For T1404, sample af848999… downloads a program from its server and runs it through a shell to gain root, in Lcore/syncsystem/methods/Priv$2;run. Quark does reach that code and fires "Executes the specified string Linux command", because Runtime.exec is an API it can match. The shell command itself, though, is assembled at runtime and handed to exec as a string argument — Runtime.exec(["/system/bin/sh", "-c", <command>]) — and Quark's rules match API calls, not the strings passed to them. Quark therefore sees that a command ran but never which one, so running an exploit and listing a directory look identical to it.

For T1644, Quark did cluster SMS handling in Lcom/sysmanager/system/SmsReceiver;onReceive, but that cluster reads and filters incoming messages. T1644 requires receiving command and control instructions over binary SMS, which the collected primitives do not show.

Both APIs are present, but no single method passes data between them (1) — T1430 Location Tracking. Quark's rules for this technique pair Location.getLatitude with Location.getLongitude. Both APIs exist in the samples and Quark reaches stage 3, but no method calls both and passes a value from one to the other, so the match stops short of the data-flow stage that a confirmed detection requires.

The behavior is real but not separable from a technique already shown (1) — T1437.001 Web Protocols. Skygofree's HTTP command and control traffic is genuine, and Quark confirms it inside Lcom/sysmanager/network/ classes such as GetCommands and StartReverse. The primitives collected there — open a URL, set a request method, read the response stream — are the generic transport that T1407's download step already rests on, rather than evidence specific to command and control signalling, so no separate cluster was attributed to this technique.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	AF848999A4B8DF0E33F5A05A618C83D1F3052D4026AB77B2ACF66DEF71DF754E
2	E6ABA7629608A525B020F4E76E4694D6D478DD9561D934813004B6903D66E44C

---

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.48%. Comparing base (528c937) to head (deda28e).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #963   +/-   ##
=======================================
  Coverage   78.48%   78.48%           
=======================================
  Files          84       84           
  Lines        7692     7692           
=======================================
  Hits         6037     6037           
  Misses       1655     1655           

Flag	Coverage Δ
unittests	78.48% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[haeter525]

LGTM.