Reverse engineers malicious Android APK files using the JADX decompiler to read Java/Kotlin source, inspect manifest permissions, receivers, services, and native libraries, and identify data theft, C2 communication, privilege escalation, or overlay-attack behavior. Use when analyzing a suspected And

Reverse Engineering Android Malware with JADX When to Use A suspicious Android APK has been reported as malicious or flagged by mobile threat detection Analyzing Android banking trojans, spyware, SMS stealers, or adware samples Determining what data an app collects, where it sends it, and what permissions it abuses Extracting C2 server addresses, encryption keys, and configuration data from Android malware Understanding overlay attack mechanisms used by banking trojans Do not use for analyzing obfuscated native (.so) libraries within APKs; use Ghidra or IDA for native ARM binary analysis. Prerequisites JADX 1.5+ installed (download from https://github.com/skylot/jadx/releases) Android SDK with aapt2 and adb tools for APK inspection apktool for full APK disassembly including smali code and resources Python 3.8+ with androguard library for automated APK analysis Frida for dynamic instrumentation (optional, for runtime analysis) Isolated Android emulator (Genymotion or Android Studio AVD) without Google services Workflow Step 1: Extract APK Metadata and Permissions Examine the APK structure and AndroidManifest.xml: Step 2: Decompile with JADX Open the APK in JADX for Java/Kotlin source analysis: Step 3: Identify Malicious Functionality Search for suspicious code patterns in decompiled sources: Step 4: Analyze C2 Communication Trace the network communication logic: Step 5: Examine Native Libraries Check for native code that may contain additional malicious logic: Step 6: Document Analysis and Extract IOCs Compile a comprehensive Android malware analysis report: Key Concepts Term Definition APK (Android Package) Android application package format containing compiled DEX bytecode, resources, manifest, and native libraries DEX Bytecode Dalvik Executable format containing compiled Java/Kotlin code; JADX converts this back to readable Java source Overlay Attack Banking trojan technique displaying a fake UI layer over a legitimate banking app to steal credentials using SYSTEM ALERT WINDOW permission Accessibility Service Abuse Malware registering as an accessibility service to capture screen content, perform actions, and prevent uninstallation Smali Human readable representation of DEX bytecode; intermediate representation between bytecode and Java used by apktool Dynamic Code Loading Loading additional DEX code at runtime using DexClassLoader to hide malicious functionality from static analysis Device Admin Abuse Malware requesting device administrator privileges to prevent uninstallation and perform device wipe threats Tools & Systems JADX : Open source DEX to Java decompiler providing GUI and CLI for Android APK analysis with deobfuscation support apktool : Tool for reverse engineering Android APK files to smali code and decoded resources androguard : Python framework for automated Android APK analysis including permission, component, and code analysis Frida : Dynamic instrumentation toolkit for hooking Java methods and native functions at runtime on Android MobSF (Mobile Security Framework) : Automated mobile application security testing framework for static and dynamic analysis Common Scenarios Scenario: Analyzing an Android Banking Trojan Context : A banking trojan APK is distributed via SMS phishing targeting customers of a specific bank. The sample needs analysis to identify targeted banks, C2 infrastructure, and data theft mechanisms. Approach : 1. Extract APK metadata and identify requested permissions (SMS, accessibility, overlay, device admin) 2. Decompile with JADX and search for overlay activity classes that mimic banking app UIs 3. Identify the list of targeted banking apps by searching for package name lists in the code 4. Trace the SMS interception receiver to understand how 2FA codes are stolen 5. Follow the C2 communication code to extract server URLs and command protocol 6. Check for web injection configuration files in assets/ directory 7. Extract all IOCs and document the complete attack chain Pitfalls : Not deobfuscating class and method names before analysis (use JADX deobf flag) Missing dynamically loaded DEX files downloaded after installation Ignoring native .so libraries that may contain the actual C2 logic or encryption routines Overlooking assets/ directory which may contain encrypted configuration or web injects Output Format

reverse-engineering-android-malware-with-jadx