A comprehensive Android malware analysis toolkit that demonstrates common attack techniques used in mobile phishing malware. Built for security research and education purposes only.
This tool replicates 15 attack techniques found in real-world Android malware:
| # | Feature | Description |
|---|---|---|
| 1 | Phishing UI | Fake login interface mimicking popular apps |
| 2 | Device Fingerprinting | Collecting device identifiers (IMEI, MAC, etc.) |
| 3 | Keylogging | Recording keystrokes via accessibility services |
| 4 | Clipboard Theft | Reading clipboard contents periodically |
| 5 | Overlay Attack | Drawing fake windows over legitimate apps |
| 6 | Accessibility Abuse | Monitoring all app inputs via accessibility services |
| 7 | HTTP Exfiltration | Sending stolen data to remote servers |
| 8 | SQLite Storage | Local database for staging stolen data |
| 9 | MD5 Hashing | Password hashing for storage/transmission |
| 10 | File Downloader | Downloading additional malicious components |
| 11 | Analytics SDK | Using analytics services for data collection |
| 12 | Boot Persistence | Auto-start on device boot |
| 13 | Base64 Encoding | Encoding data to evade detection |
| 14 | Attack Chain | Complete attack workflow demonstration |
| 15 | One-Click Demo | Demonstrate all techniques at once |
- Do NOT use for unauthorized access to computer systems
- Do NOT use to harm others or steal data
- Do NOT distribute for malicious purposes
- Use only in controlled environments for learning
git clone https://github.com/0718lol/MalwareDemo.git
cd MalwareDemo
pip install requests
python demo.py- Run
demo.py - Click each attack module to demonstrate
- Observe how stolen data is collected
- Study the attack techniques for defensive purposes
The tool demonstrates how mobile phishing malware operates:
1. Victim installs fake app (mimicking QQ/WeChat/etc.)
2. App displays fake login界面
3. Victim enters credentials
4. Credentials are stolen and stored
5. Data is exfiltrated to attacker's server
- Only install apps from official app stores
- Enable "Unknown Sources" installation restriction
- Use mobile security software
- Never enter credentials in suspicious apps
- Enable two-factor authentication
一个综合性的 Android 恶意软件分析工具，演示移动钓鱼恶意软件中常见的攻击技术。仅供安全研究和教育目的使用。
本工具复现了真实 Android 恶意软件中的 15 种攻击技术：
| # | 功能 | 说明 |
|---|---|---|
| 1 | 钓鱼界面 | 模仿流行应用的假登录界面 |
| 2 | 设备指纹 | 收集设备标识（IMEI、MAC等） |
| 3 | 键盘记录 | 通过无障碍服务记录按键 |
| 4 | 剪贴板窃取 | 定期读取剪贴板内容 |
| 5 | 悬浮窗攻击 | 在合法应用上绘制假窗口 |
| 6 | 无障碍滥用 | 通过无障碍服务监控所有应用输入 |
| 7 | HTTP外发 | 将窃取的数据发送到远程服务器 |
| 8 | SQLite存储 | 本地数据库暂存窃取的数据 |
| 9 | MD5加密 | 密码哈希处理 |
| 10 | 文件下载器 | 下载额外的恶意组件 |
| 11 | 分析SDK | 使用分析服务收集数据 |
| 12 | 开机自启 | 设备启动时自动运行 |
| 13 | Base64编码 | 编码数据以逃避检测 |
| 14 | 完整攻击链 | 完整攻击流程演示 |
| 15 | 一键演示 | 一次性演示所有技术 |
- 不得用于未经授权访问计算机系统
- 不得用于伤害他人或窃取数据
- 不得用于恶意目的分发
- 仅在受控环境中用于学习
git clone https://github.com/0718lol/MalwareDemo.git
cd MalwareDemo
pip install requests
python demo.py- 运行
demo.py - 点击各个攻击模块进行演示
- 观察窃取数据的收集过程
- 学习攻击技术以用于防御目的
本工具演示了移动钓鱼恶意软件的工作方式：
1. 受害者安装假应用（模仿QQ/微信等）
2. 应用显示假登录界面
3. 受害者输入凭据
4. 凭据被窃取并存储
5. 数据被外发到攻击者服务器
- 只从官方应用商店安装应用
- 启用"未知来源"安装限制
- 使用移动安全软件
- 不要在可疑应用中输入凭据
- 启用双重身份验证
MIT License - See LICENSE for details.
Contributions are welcome! Please read the Contributing Guide first.
This project is for educational purposes only. The authors are not responsible for any misuse of this software.