Reverse Engineering Android Malware with Claude Code

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://zanestjohn.com/blog/reing-with-claude-code
• Blog Title: Reverse Engineering Android Malware with Claude Code
• Suggested Section: Mobile Pentesting > Android Applications Pentesting, with cross-links to Basic Forensic Methodology > Malware Analysis and Hardware/Physical Access > Firmware Analysis

🎯 Content Summary

Reverse Engineering Android Malware with Claude Code

The post investigates a cheap AliExpress/Magcubic HY300 Pro+ Android projector that began generating suspicious DNS traffic immediately after Wi-Fi setup, before the user opened any app or browser. Pi-hole observed domains such as o.fecebbbk.xyz, impression.appsflyer.com, and later usmyip.kkoip.com. The device ran Android 11 / API 30, used a production build, was not signed with test keys, and ...

🔧 Technical Details

Automated XOR deobfuscation of Android malware strings: Malware often stores C2 domains, paths, commands, algorithm names, and identifiers as encrypted byte arrays decoded at runtime. In this case, the Java routine XORs each byte with a rotating key and returns a string. Analysts can reproduce the logic offline, handle Java signed bytes with & 0xFF, walk the decompiled jadx output, and decrypt all call sites to recover infrastructure such as api.pixelpioneerss.com, payload directories such as TMRXwWJu3G5, SharedPreferences names, campaign IDs, and shell commands like chmod 777 .

Platform-signed Android malware as a privilege and persistence primitive: An APK declaring android:sharedUserId="android.uid.system" and signed with the platform certificate executes with Android system privileges. If it is preinstalled in firmware, it should be treated as firmware/supply-chain compromise rather tha...

🤖 Agent Actions

Done — I updated:

• src/mobile-pentesting/android-app-pentesting/README.md

What I added:

• platform-signed android.uid.system malware triage
• boot persistence indicators (systemExempted, START_STICKY, NetworkCallback, boot receiver)
• automated rotating-XOR string recovery guidance from JADX output
• AES-C2 framing where IV/key are appended in plaintext
• firmware reinfection / Play Protect disabling / silent preinstall indicators
• ADB live-response commands for preinstalled Android malware
• residential-proxy enrollment as a stage-3 objective

I kept everything in a single file and reused the existing Android malware tradecraft section. I also normalized the blog reference title in the existing ## References section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://zanestjohn.com/blog/reing-with-claude-code

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting, with cross-links to Basic Forensic Methodology > Malware Analysis and Hardware/Physical Access > Firmware Analysis".

Repository Maintenance:

• MD Files Formatting: 974 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0