Quark-Engine
Introduces Quark-Engine, an open-source Python malware scoring and analysis framework for Android applications.
Summary
Android Malware Scoring Architecture
Quark-Engine is an open-source malware scoring and analysis framework written in Python, designed to dissect Android application packages systematically.
Mapping Behaviors to Legal Perspectives
The engine structures its behavioral evaluation around legal classifications inspired by criminal law concepts, mapping permission combinations and API calls to definitive malicious intents.
Automated Triage and Rule Generation
Analysts can integrate Quark-Engine into automated triage workflows to score samples rapidly, detect stealthy evasion tactics, and generate consistent detection signatures.
Related talks
Main Stage·47 min
Hugo Gonzalez · Caleb Howell
Deconstructs the anti-cheat and runtime integrity mechanisms in Pokemon Go, demonstrating mobile reverse engineering and integrity bypass tradecraft.
Blue Team Village·36 min
Project Obsidian
Project Obsidian walks through triaging and reverse engineering high volumes of malicious email attachments and phishing lures.
Blue Team Village·43 min
Project Obsidian
Project Obsidian explores methods for decoding and analyzing heavily obfuscated PowerShell scripts used in initial access payloads.