View Issue Details
|ID||Project||Category||View Status||Date Submitted||Last Update|
|0007121||Kali Linux||Queued Tool Addition||public||2021-03-30 03:09||2021-04-21 14:31|
|Reporter||Erika carpenter||Assigned To||sbrun|
|Priority||normal||Severity||minor||Reproducibility||have not tried|
|Fixed in Version||2021.2|
|Summary||0007121: Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System|
Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System
With ideas decoded from criminal law, Quark-Engine has its unique angles for Android analysis. We developed a Dalvik bytecode loader that has tainted analysis inside but also defeats the obfuscation techniques used against reverse engineering. And surprisingly, the loader matches perfectly the design of our malware scoring system.
Quark-Engine is very easy to use and also provides flexible output formats. There are three types of output reports: detail report, call graph, and summary report. With these reports in mind, you can get an overview of the high-risk behavior inside Android within seconds.
Also, by integrating with other Android analysis tools such as Ghidra, APKLAB, Jadx, Quark-Engine can greatly improve the efficiency of reverse engineers.
Quark-Engine already presented at DEFCON 28 BTV, HITB Lockdown 002, and will release more features at BlackHat Asia 2021 Arsenal. Also, Quark-Engine is now integrated with many open-source tools, such as IntelOwl, BlackArch Linux, Pithus/Bazaar, and APKLAB.
We have experiences (ghidraquark, APKLab) developing a feature that when users click on one of the activities, the corresponding smali source codes are highlighted for manual verification. This boosts up the speed for malware analysts.
@kali-team, please could this be packaged up.
Thank you Kali Linux team for the acceptance of quark-engine, I'd love to work on the packaging.
Hello @g0tmi1k @kali-team,
I have packaged the quark-engine to Debian package in the latest release version "v21.4.3".
The .deb file could be download here:
Our Debian setting directory:
@krnick Thanks for the Debian package.
I have uploaded in Kali quark-engine. It will be available soon.
FYI "dpkg -i quark-engine_21.4.3-0kali1_all.deb" does not install the missing dependencies even if they are listed in debian/control. That's why dpkg fails. If you use "dpkg -i" you need to run "sudo apt install -f" after to install the missing dependencies. Or you can run directly "sudo apt install ./quark-engine_21.4.3-0kali1_all.deb"
the package is in kali-rolling
|2021-03-30 03:09||Erika carpenter||New Issue|
|2021-03-30 03:09||Erika carpenter||Issue generated from: 0007082|
|2021-04-08 03:14||krnick||File Added: 螢幕快照 2021-04-07 下午11.26.38.png|
|2021-04-08 03:14||krnick||File Added: 螢幕快照 2021-04-07 下午11.26.56.png|
|2021-04-08 03:14||krnick||File Added: 螢幕快照 2021-04-08 上午11.07.45.png|
|2021-04-08 03:14||krnick||Note Added: 0014437|
|2021-04-08 06:27||sbrun||Assigned To||=> sbrun|
|2021-04-08 06:27||sbrun||Status||acknowledged => assigned|
|2021-04-20 13:50||sbrun||Note Added: 0014472|
|2021-04-20 15:13||sbrun||Relationship added||has duplicate 0007082|
|2021-04-21 14:31||sbrun||Status||assigned => resolved|
|2021-04-21 14:31||sbrun||Resolution||open => fixed|
|2021-04-21 14:31||sbrun||Fixed in Version||=> 2021.2|
|2021-04-21 14:31||sbrun||Note Added: 0014473|