Mobile Malware Analysis

Yes, when done defensively. This course teaches you to understand and report on samples, never to build or spread them. You work only on an isolated device or VM with no real accounts or SIM, obtain samples through legitimate channels, and treat every sample as live. Isolation protects both you and any network the sample could touch.

Isolation stops the sample from exfiltrating real data, enrolling your accounts or spreading, and it gives a clean, repeatable baseline. On a device loaded with your own apps and accounts you cannot tell which behaviour came from the sample. A pristine snapshot is both a safety control and a measurement control.

Read permissions as a capability budget. Accessibility Service combined with draw-over-other-apps and install-unknown-apps is a classic banking-overlay backbone: it lets an app watch the screen, deceive the user with fake overlays and extend itself. SMS and notification-listener access signal OTP and two-factor interception.

Static triage, reading the manifest, permissions and strings, is cheap and safe and lets you form a hypothesis about what the sample is. Running it blind wastes the run because you do not know what to watch for. Static first turns the riskier dynamic phase into a targeted test of a specific hypothesis.

Behavioural indicators and techniques are the most durable because they survive repacking. Command-and-control domains and URLs are next, then signing certificates and distinctive strings. A file hash is precise but least durable, since a one-byte change invalidates it, so a good report leads with behaviour.