Add Quark malware analysis report for Dendroid

[pulorsok]

Dendroid Malware Family Analysis Report

This report analyses the Dendroid malware family using Quark's rule classification. Dendroid is a commercial Android RAT sold on underground forums from 2014, whose source code later leaked and seeded a number of derivatives. It is operated through a web panel and disguises itself as a parental-control application. This run did not add a new rule for Dendroid. Check here for the rule set details.

Quark's rule classification flagged 2 of 2 Dendroid samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0301 Dendroid software entry. Of the 8 techniques documented for the family, Quark's static bytecode analysis confirms the 3 listed below; see the coverage-gap notes at the end of this section for the other 5.

MITRE Technique	Real-world manifestation
T1429 Audio Capture	Recording ambient audio or phone calls via microphone access for surveillance
T1533 Data from Local System	Reading stored communication records — sent messages and call logs — from the device's own providers
T1636.004 SMS Messages	Harvesting SMS message content including authentication codes and personal communications

All behavior maps below were rendered from sample 099a57328de9335c524f44514e225d50731c808145221affdd684d8b4dad5a1d.apk (package com.parental.control.v4) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Dendroid. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1429 Audio Capture — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

RecordService;onStart directly invokes the MediaRecorder API to initialize the recorder and begin capturing audio. This call enables the service to record ambient sound without user interaction.

Behaviors detected by Quark:

• Initialize the recorder and start recording (Clean Up the Direct Use of MethodAnalysis (Sourcery refactored) #198)

2. T1533 Data From Local System

T1533 Data from Local System — attack.mitre.org

MITRE definition (T1533): Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges.

MyService$getSentSms;doInBackground queries content providers through ContentResolver, including the SMS and call-log URIs, and pulls out message bodies and addresses. This task reads the messages the device has sent; the inbox side is covered separately under T1636.004 below.

Behaviors detected by Quark:

• Query data from URI (SMS, CALLLOGS) (Welcome gwalstat #11)
• Read sensitive data(SMS, CALLLOG, etc) (UnicodeEncodeError: 'gbk' codec can't encode character '\u037d' #77)
• Query a URI and check the result (fix prompt-toolkit version #187)
• Get the address of a SMS message (Bug in the call graph function #188)
• Get the content of a SMS message (Refactor/enrich the rest of Quark's tests #189)
• Query a URI and append the result into a string (Refactor/enrich the rest of Quark's tests (Sourcery refactored) #190)
• Query device data with ContentResolver (Add an Optional Parameter Filter For JSON Rules #212)
• Query device data with ContentResolver and a URI parsed from a string (Backward Compatible API #222)
• Accessing sensitive data from content provider (add save png funcionality of behaviors_comparison_radar_chart function #271)

3. T1636.004 SMS Messages

T1636.004 SMS Messages — attack.mitre.org

MITRE definition (T1636.004): Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.

MyService$getInboxSms;doInBackground queries the SMS inbox provider and extracts the body and sender address of each stored message. Where the task above reads sent messages, this one harvests everything the device has received.

Behaviors detected by Quark:

• Get the address of a SMS message (Bug in the call graph function #188)
• Get the content of a SMS message (Refactor/enrich the rest of Quark's tests #189)
• Get messages in the SMS inbox (Show Parent Functions' Cross-References in Rule Classification #191)

Coverage-gap notes

The 5 MITRE techniques documented for Dendroid that this report does NOT demonstrate, grouped by the reason Quark could not confirm them:

Present in the samples but not shown as a section above (2) — T1512 Video Capture and T1582 SMS Control. Quark confirms both at full data-flow depth inside Dendroid's own classes: Lcom/connect/CameraView reads and changes camera parameters while Lcom/connect/VideoView and MyService$recordAudio write recorded media to disk; MyService$deleteSms removes messages through the SMS content URI and MyService$sendText sends them. Both behaviours are real and attributable to the family — they are recorded here for completeness.

The samples do not exhibit the behaviour (1) — T1655.001 Match Legitimate Name or Location. The matching rules do fire, but only inside bundled library code, so nothing here can be credited to Dendroid.

One of each rule's two APIs is absent (2) — T1417.002 GUI Input Capture and T1633.001 System Checks. Quark confirms a rule only when both of its APIs appear in the APK, and for these two that never happens: the accessibility APIs the keylogging rules pair against are not called anywhere in the samples, and neither are the second halves of the device-check rules.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	099A57328DE9335C524F44514E225D50731C808145221AFFDD684D8B4DAD5A1D
2	0B8BA0C6CEBE5695639BF1B282B52F126DBA733F3C204E37615A3BA5F7DD6FE8

---

🤖 Generated with Claude Code

[haeter525]

LGTM. Thanks @pulorsok