Add Quark malware analysis report for RuMMS

[pulorsok]

RuMMS Malware Family Analysis Report

This report analyses the RuMMS malware family using Quark's rule classification. RuMMS is an Android SMS-stealing family documented by FireEye in 2016, spread to users in Russia through SMS phishing links. Once installed it hides its icon, registers the device with its command and control server, and uploads incoming SMS messages to it. This run did not add a new rule for RuMMS. Check here for the rule set details.

Quark's rule classification flagged 3 of 3 RuMMS samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0313 RuMMS software entry. Of the 4 techniques documented for the family, Quark's static bytecode analysis confirms the 2 listed below; see the coverage-gap notes at the end of this section for the other 2.

MITRE Technique	Real-world manifestation
T1422 System Network Configuration Discovery	Collecting the device phone number and IMEI and sending them to the command and control server
T1636.004 SMS Messages	Uploading incoming SMS messages to the command and control server

All behavior maps below were rendered from sample 09161f0f22270c8c8be6d47a3b64c909ef0570f95c9e6ecdb8004d84699ba435.apk (package org.zxformat, disguised as "Infinite Flight") — chosen as the representative sample whose detected behaviors most fully cover the documented profile of RuMMS. The other 2 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.

1. T1422 System Network Configuration Discovery

T1422 System Network Configuration Discovery — attack.mitre.org

MITRE definition (T1422): Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems. On Android, details of onboard network interfaces are accessible to apps through the java.net.NetworkInterface class. Previously, the Android TelephonyManager class could be used to gather telephony-related device identifiers, information such as the IMSI, IMEI, and phone number.

Lorg/zxformat/o;y reads the device's phone number through TelephonyManager. Its sibling helper Lorg/zxformat/o;t reads the IMEI the same way, which Quark also confirms in this sample (#33).

Behaviors detected by Quark:

• Query the phone number (Merge (#37) into dev #38)

2. T1636.004 SMS Messages

T1636.004 SMS Messages — attack.mitre.org

MITRE definition (T1636.004): Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.

Lorg/zxformat/Ma;onReceive handles incoming SMS. It reads the message body directly and calls one helper to read the sender's phone number.

Behaviors detected by Quark:

• Query the SMS contents (Xrule bugfix #48)
• Query the phone number from SMS sender (Bugfix for issue #46 #49)

Coverage-gap notes

The 2 MITRE techniques documented for RuMMS that this report does NOT demonstrate:

T1426 System Information Discovery — RuMMS reads the device model and Android version from Build.MODEL and Build.VERSION.RELEASE in Lorg/zxformat/v. These are fields, not method calls, and Quark rules only match method calls.

T1437.001 Web Protocols — RuMMS talks to its server through Apache HttpClient (DefaultHttpClient with HttpPost, in Lorg/zxformat/r), and no rule in the pool covers those APIs. The HTTP rules that do fire land in Lorg/zxformat/n, which is the Picasso image-loading library renamed into the malware's package, not the command and control code.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	09161F0F22270C8C8BE6D47A3B64C909EF0570F95C9E6ECDB8004D84699BA435
2	930654125E948B873EE504A12C72A0719848B91F39AF9438E43698E501A08D3F
3	9A567725FA8800823E9B02D713D489CD174BD83C90984E87C6E0781C456D56CF

🤖 Generated with Claude Code

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[haeter525]

LGTM. Thanks.