HACKING PROJECT · mobile · Intermediate
YARA-Based Mobile Malware Scanner (OWASP MASVS)
Deliver an APK/IPA triage scanner that applies YARA rules across mobile artifacts and outputs a prioritized, MASVS-mapped malware verdict.
Android malware families (droppers, bankers, stalkerware, spyware) proliferate through sideloaded APKs and third-party stores where Play Protect coverage is weak. Analysts and mobile MDM teams need lightweight, signature-driven triage before deep dynamic analysis, but generic desktop AV rarely understands APK structure (DEX, manifest, resources, native libs). There is a gap in tooling that applies curated YARA rules directly to unpacked mobile artifacts with MASVS-aware context.
**What you'll build**
Build a scanner that ingests APK/IPA files, unpacks them (apktool/unzip, DEX-to-strings, manifest parse), and runs a curated YARA ruleset against DEX bytecode, native .so libraries, embedded assets, certificates, and the manifest to flag known malware indicators and suspicious permission/capability combinations. Produce a structured verdict report mapping findings to MASVS categories and malware family/behavior tags. Wrap it in a CLI plus optional REST API for MDM/CI integration.
**Objective** — Deliver an APK/IPA triage scanner that applies YARA rules across mobile artifacts and outputs a prioritized, MASVS-mapped malware verdict.
**Expected outcome** — A working YARA-based mobile scanner with a curated ruleset and a JSON/HTML triage report for submitted samples.
**Difficulty** — Intermediate — combines APK internals, YARA authoring, and pipeline building without requiring deep dynamic RE.
**Primary category** — Malware Analysis; Secondary = Threat Detection, Mobile AppSec
**Security domains** — Primary = Malware Analysis; Secondary = Blue Team, Threat Intelligence, DevSecOps
**Technical focus** — Static malware triage, YARA rule authoring, APK/DEX parsing, manifest/permission analysis, native-library scanning, IOC extraction, signature detection, detection engineering
**Core technologies** — Languages: Python, YARA rule language; Frameworks/Libraries: yara-python, androguard, apkutils; Security Tools: YARA, apktool, jadx, MobSF (reference), VirusTotal API (optional); Cloud/Infra: Docker, optional serverless scan API; AI/Data: sample corpora from MalwareBazaar/AndroZoo, optional ML classifier; Databases: SQLite/PostgreSQL for scan results and IOC store
**Where it's valued** — MSSPs, mobile EMM/MDM vendors, antivirus/endpoint security, financial services, threat-intel providers
**Careers it builds toward** — Malware Analyst, Detection Engineer, Threat Intelligence Analyst, Mobile Security Engineer
**Framework alignment**
• MITRE ATT&CK: ATT&CK for Mobile — Download New Code at Runtime (T1407), Obfuscated Files or Information (T1406), Masquerading (T1655), Suppress Application Icon (T1508); technique tagging in rule metadata
• NIST CSF 2.0: Identify (malware IOC cataloging), Detect (signature-based detection), Respond (triage/verdict)
• OWASP: MASVS-CODE, MASVS-RESILIENCE, MASVS-PLATFORM (permission/manifest abuse)
• CIS Controls v8: 10 (Malware Defenses), 13 (Network Monitoring & Defense), 8 (Audit Log Management)
**Innovation** — Improved Existing Solution — YARA and APK scanners exist separately, but a MASVS-tagged, mobile-artifact-aware YARA pipeline with family tagging is a genuinely useful, portfolio-strong tool. Scores: Innovation 6/10, Startup 5/10, Enterprise-Readiness 6/10, Patent = No.