Mobile Malware Analysis: From Dropper to C2 Beaconing

Mobile Malware Analysis: Dropper, Injection & C2 Beaconing

By Security Research Team | Intermediate/Advanced

TL;DR: We analyze real-world Android malware stages: the DexClassLoader dropper, native library injection, obfuscation techniques, and Command & Control (C2) communication. Includes IoCs and detection rules.

Stage 1: The Dropper

Most Android malware begins as a seemingly benign app on third-party stores. The dropper's job is to evade Google Play Protect while fetching the real payload.

DexClassLoader loader = new DexClassLoader(
    encryptedDexPath,
    context.getCacheDir().getAbsolutePath(),
    null,
    context.getClassLoader()
);
Class<?> payloadClass = loader.loadClass("com.evil.Payload");
Method main = payloadClass.getMethod("run", Context.class);
main.invoke(null, context);

Stage 2: Native Library Injection

Advanced malware loads native .so libraries via System.loadLibrary(). Native code is harder to decompile and can hook system calls via substrate/xposed.

// ARM64 inline hook via trampoline
void hook_function(void* target, void* replacement) {
    uint32_t trampoline[] = {
        0x58000050,  // LDR X16, [PC, #8]
        0xD61F0200,  // BR X16
        (uint64_t)replacement,
        (uint64_t)replacement >> 32
    };
    memcpy(target, trampoline, 16);
    __clear_cache(target, target + 16);
}

Real Case: CryptoBot (2024) used a native .so to hook SSL_read/SSL_write via PLT hooking, exfiltrating cryptocurrency wallet private keys from Trust Wallet and MetaMask in real-time over DNS tunneling.

Stage 3: Evasion & Obfuscation

Technique	Implementation
String Encryption	All strings XOR'd with runtime key, decrypted via JNI
Reflection	Class.forName() + Method.invoke() to hide API calls
Emulator Detection	Check Build.FINGERPRINT, /proc/cpuinfo, QEMU guest kernel drivers
Time-based	Sleep(30s) before payload — bypass sandbox timeouts

Stage 4: C2 Beaconing

The beacon uses HTTPS with certificate pinning to avoid simple MITM. The C2 URL is often domain-fronted via Cloudflare. Modern C2 beacons mimic Google Analytics or Firebase traffic.

IoCs: Unusual ssl_pinning in cleartext traffic, periodic 60-300s network calls to CDN endpoints, User-Agent anomalies with suspicious UUIDs.

---

Defense Recommendations

• Monitor DexClassLoader usage via Play Integrity + custom detection
• Use StrictMode to detect unexpected native library loads
• Deploy DNS over HTTPS (DoH) with threat intelligence feeds
• Run dynamic analysis with Frida + objection

Tags: #MalwareAnalysis #AndroidMalware #C2 #Dropper #ReverseEngineering