An obfuscation-neglect Android malware scoring system that analyzes APKs for malicious behavior patterns.
Quark Engine is an open-source Android malware analysis system that scores APK files based on detected malicious behaviors. It uses a rule-based approach to identify threat patterns even in obfuscated code, helping security researchers classify malware families and assess risk. The tool generates detailed reports that map observed activities to known malware signatures.
Android security researchers, malware analysts, and threat intelligence teams who need to analyze potentially malicious APK files. It's also valuable for organizations building internal Android app security pipelines.
Quark Engine provides a specialized, obfuscation-resistant analysis method that focuses on behavioral patterns rather than surface signatures. Its rule-based system is extensible and produces actionable scoring, making it a practical choice for systematic malware assessment.
Quark Engine is a static analysis tool designed to detect and score Android malware by identifying malicious behavior patterns within APK files. It specializes in analyzing obfuscated malware, providing security researchers and analysts with a systematic way to assess threats. The tool generates detailed reports that map observed behaviors to known malware families, helping to classify and understand new variants.
Quark Engine is built on the principle that malicious intent can be uncovered through behavioral analysis, regardless of code obfuscation techniques. The project emphasizes practical, rule-driven detection that benefits the broader security community.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Excels at detecting malicious behaviors in obfuscated code by focusing on behavioral patterns, as emphasized in its philosophy of uncovering intent regardless of obfuscation techniques.
Supports custom rule creation and updates through an open-source database, allowing teams to adapt to new threats, evidenced by its involvement in GSoC projects for rule generation.
Correlates detected behaviors with known families like DroidKungFu and SpyNote, providing clear classification aids in the summary reports showcased in the README.
Generates concise reports highlighting critical findings, as shown in the quick start output, making it efficient for analysts to prioritize risks.
Cannot detect runtime-only malware behaviors, such as dynamic code loading or environment-specific attacks, limiting its scope to pre-execution analysis.
Effectiveness relies on up-to-date rules requiring regular downloads via 'freshquark' and manual updates, adding operational overhead for new or evolving threats.
Designed solely for Android APK files, with no support for iOS, web, or other application types, restricting its use in cross-platform security workflows.