Quark-Engine

Android malware scoring and analysis system that is obfuscation-neutral.

Black Hat Arsenal Black Hat Arsenal HITB defcon
build status codecov license python version PyPi Download
Twitter
Quark-Engine

Malware Family Analysis Report Showcase

Quark-Engine - e8f150e8 a27f 4d0f b3f0 346714a4cdc4Quark-Engine - 1a209c41 7f14 4a71 957a 637148e8a5ecQuark-Engine - ad93ee2d e65d 4ac6 8df2 909153151f68
Quark-Engine - ea66a178 0eb1 4832 9b3f 745b973639aaQuark-Engine - 342a4e3f 33bd 4ff4 92ed 7869356ee1c7Quark-Engine - a95e99b1 b7aa 4672 89be cd2f6bc9e3cd
Quark-Engine - 311fbc66 0e41 47f0 a3e7 7601e074050fQuark-Engine - 0b79b59f 7f76 40e1 8891 78714c06cffbQuark-Engine - 3b906cc0 d956 4ab2 851d 5da2767926e8
Quark-Engine - 1523eeb8 cfca 4c5a b63d 38887312b673Quark-Engine - 60b5afac 3244 480e 9aad 0337183bc6a0Quark-Engine - ea8d1e15 234b 4197 8d3e 1984fcacb6c7
Quark-Engine - b3437fa0 e1a7 465c 8de7 92b25ba99edaQuark-Engine - fb4c16ba a266 4453 b335 ad470a23e2e5Quark-Engine - dd7cae0f c27d 41cb 8e56 813aa2ff5997
Quark-Engine - e1c2b16a 819e 4399 8b9e 79899ee2d1b8Quark-Engine - 03b5a2e2 7dda 4fb7 8462 d2a83bf38bbbQuark-Engine - aa51bd06 de3e 4bcc 95cd 22ecc8b27c01
Quark-Engine - 986d23eb 48de 459f 9714 f4685fd3e696Quark-Engine - d175889c 1442 428d 911a 628b5cdbb7d4Quark-Engine - 514f2dd2 d456 42b9 8d15 18e6988e3aa5
Quark-Engine - 9eaf2751 1579 4fba 9d71 d201b723dc4dQuark-Engine - dfe535ee 71fa 499b 98eb 0a8f4854182cQuark-Engine - d827122b 63cf 4370 895d e38a274d19c9
Quark-Engine - f39034b9 4920 421d 9078 d030c3409571Quark-Engine - 98db18dc 526c 481f bf4f 62bea5fde5eeQuark-Engine - aabc5739 074c 4336 9352 c79a6b737067
Quark-Engine - 91d88a98 5387 401c b8a9 d09b122ba681Quark-Engine - 7a608c0d 8e12 4b77 92cd b785c5572f2cQuark-Engine - 276ab27a 3880 4847 8aec 3ed5f77949bc
FamilySummarySignature BehaviorsReport
DroidKungFuPrivilege escalation with C2 control.1. Gain unlimited access to a device.
2. Install/Uninstall additional apps.
3. Forward confidential data.		View
GoldDreamSMS/call log exfiltration with remote C2 commands.1. Monitor SMS messages and phone calls.
2. Upload SMS messages and phone calls to remote servers.		View
SpyNoteCredential theft and device surveillance via RAT.1. Take screenshots.
2. Simulate user gestures.
3. Log user input.
4. Communicate with C2 servers.		View
DawDropperDropper that installs banking trojans for financial theft.1. Download APKs from remote servers.
2. Install additional APKs.		View
SLockerAndroid ransomware locking/encrypting devices.1. Lock the device with an overlay screen.View
PhantomCardNFC relay–based financial fraud.1. Communicate with C2 servers.
2. Read the payment data of NFC cards.
3. Captures PINs of NFC cards through deceptive screens.		View
ToxicPandaBanking trojan enabling on-device fraud.1. Abuse Accessibility.
2. Remote device control.
3. Intercept OTP.		View
HydraBanking trojan using overlay attacks.1. Overlay credential theft.
2. Accessibility abuse.
3. Steal OTP/cookies.		View
SharkBotBanking trojan targeting financial credentials and transactions.1. Abuse Accessibility services.
2. Perform overlay attacks to steal credentials.
3. Intercept SMS messages (OTP).		View
AntidotBanking trojan disguised as legitimate updates for financial data theft.1. Intercept SMS messages (OTP).
2. Log user input (keylogging).
3. Enable remote control via C2.		View
ArsinkBanking trojan focusing on credential and financial data exfiltration.1. Steal sensitive data from device.
2. Intercept SMS messages (OTP).		View
TrickMoBanking trojan using overlay attacks and accessibility abuse for credential theft.1. Overlay attacks to steal banking credentials.
2. Intercept SMS for 2FA bypass.
3. Screen recording and accessibility abuse.
4. Dynamic payload loading via reflection.		View
AnubisBanking trojan with RAT capabilities.1. Overlay credential theft.
2. Keylogging.
3. Intercept SMS (OTP).
4. Remote control via C2.		View
GodFatherBanking trojan targeting financial credentials through overlay and accessibility abuse.1. Perform overlay attacks to steal credentials.
2. Abuse Accessibility services.
3. Intercept SMS messages (OTP).
4. Steal banking credentials and sensitive data.		View
TangleBotSMS-based Android malware stealing personal and financial data.1. Spread through SMS phishing links.
2. Control device interactions and overlay screens.
3. Access SMS, contacts, call logs, camera, and microphone.
4. Steal account and financial information.		View
BRATABanking trojan with remote control and anti-analysis capabilities.1. Perform overlay attacks to steal banking credentials.
2. Abuse Accessibility services for device control.
3. Intercept SMS messages (OTP).
4. Execute factory reset or device wipe commands.		View
CerberusBanking trojan targeting financial credentials through overlay and device control.1. Perform overlay attacks to steal credentials.
2. Abuse Accessibility services.
3. Log user input (keylogging).
4. Enable remote control via C2.		View
SuperCardXNFC relay malware enabling contactless payment fraud.1. Read NFC payment card data.
2. Relay NFC transactions to attacker-controlled devices.
3. Communicate with C2 servers.
4. Facilitate unauthorized contactless payments.		View
NGateNFC-based malware enabling relay attacks and payment fraud.1. Read NFC payment card data.
2. Relay NFC communications to attacker-controlled devices.
3. Communicate with C2 servers.
4. Facilitate unauthorized contactless payments.		View
AhRatAndroid RAT capable of surveillance and data theft.1. Record audio from the device.
2. Steal files and sensitive data.
3. Remote access via C2.
4. Execute remote commands.		View
AndroRatAndroid remote access trojan for device surveillance.1. Record audio and capture video.
2. Track device location.
3. Steal files and device information.
4. Execute remote commands.		View
SovaAndroid banking trojan distributed as trojanised carrier apps for credential theft and SMS fraud.1. Read device identifiers via the C2 ping-response handler.
2. Inject outbound SMS on operator command.
3. Place phone calls without user consent.		View
EventBotBanking trojan and infostealer targeting 200+ financial apps.1. Enumerate installed applications to pick targets.
2. Intercept incoming SMS via a broadcast receiver.
3. Exfiltrate SMS bodies over HTTP to defeat 2FA.		View
SkygofreeAndroid spyware designed for surveillance and sensitive data collection.1. Capture audio.
2. Access stored application data.
3. Download new code at runtime.
4. Capture video.		View
ChrysaorAndroid build of the Pegasus spyware developed by NSO Group.1. Capture audio.
2. Check Internet connectivity.		View
DendroidCommercial Android RAT sold on underground forums.1. Capture audio.
2. Access data from the local system.
3. Gather SMS messages.		View
RuMMSAndroid SMS-stealing family spread through SMS phishing links.1. Discover network configuration.
2. Gather SMS messages.		View
ExodusAndroid surveillanceware delivered through decoy mobile-operator service apps.1. Discover installed applications.
2. Discover network configuration.
3. Gather call log data.		View
BrainTestAndroid malware found in a Google Play game that runs root exploits and pulls further code from its server.1. Download new code at runtime.View
HerodotusAndroid banking trojan built for device takeover, sold as malware-as-a-service.1. Access data from the local system.View

Quick Start

Step 1. Install via PyPi

Install the latest version of Quark Engine:

$ pip3 install -U quark-engine

Step 2. Download Latest Rules

Fetch the latest rule database:

$ freshquark

Step 3. Run Summary Report

Analyze an APK with the downloaded rules and generate a summary report:

$ quark -a <apk_file> -s

Step 4. View Results

Example output: Screenshot-2025-11-25-22-36-54

Quark-Engine Skills

Quark-Engine also ships two Claude Code skills:

  • /quark:analysis — analyze an APK with Quark-Engine
  • /quark:rule-gen — generate a Quark rule from decompiled code

To install, run these commands inside Claude Code after installing Quark-Engine:

/plugin marketplace add ev-flow/quark-engine
/plugin install quark@quark-engine

The skills then should appear.

Acknowledgments

The Honeynet Project

Honeynet.org logo

Google Summer Of Code

Quark-Engine has been participating in the GSoC under the Honeynet Project!

Stay tuned for the upcoming GSoC! Join the Honeynet Slack chat for more info.

Core Values of Quark Engine Team

  • We love battle fields. We embrace uncertainties. We challenge impossibles. We rethink everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others first.