Hey AndroGuard, I Will Crash Your Python Buddy! | Zscaler
The article describes anti-analysis techniques found in certain Android malware samples designed to crash the AndroGuard APK analysis tool or its Python zipfile dependency, similar to anti-debugging tricks used by PC malware against tools like OllyDbg and IDA Pro. Techniques include crafting malformed 'linksize'/'linkoff' padding values that trigger unpack() failures due to 4-byte alignment issues in zipfile.py, and manipulating AndroGuard's search_methods() return values to conceal malicious behaviors like audio recording. The AndroGuard project addressed the zipfile parsing issue in a December 2012 patch.
- md522ff8b141bc187095ded6a431073028cSample of Android/Wooboo malware family that crashes AndroGuard's Python zipfile parsing via crafted padding values
Detection / HunterAnthropic
What Happened
Security researchers found that some malicious Android apps are built to break analysis tools used by security professionals, specifically a popular tool called AndroGuard that scans app files for threats. The malware does this by including oddly formatted data that causes the scanning tool (and the Python programming language component it relies on) to crash, preventing analysts from properly inspecting the app. This mainly affects security researchers and analysts who use this tool rather than everyday users, but it matters because it shows malware authors are actively trying to evade detection and analysis. The tool's developers already released an update in December 2012 that fixes the crashing issue, so anyone using AndroGuard for app analysis should make sure they are running the latest version.
Key Takeaways
- Some Android malware samples use crafted APK structures to crash AndroGuard (a popular Python-based APK analysis tool) or its underlying Python zipfile library, hindering static analysis.
- One technique abuses uncommon padding values in 'link_size' and 'link_off' fields to trigger unpack failures due to Python's 4-byte alignment handling in zipfile.py.
- A sample identified as Android/Wooboo (MD5: 22ff8b141bc187095ded6a431073028c) exploited this weakness; only 5 of many AV engines detected it as malicious at the time.
- Malware can also manipulate return values from AndroGuard's search_methods() function to hide risky behaviors such as audio/voice recording (e.g., abuse of MediaRecorder APIs).
- The AndroGuard project patched zipfile.py in a December 2012 update to resolve the unpacking crash issue; analysts are advised to update to the latest version.
Affected Systems
- AndroGuard APK analysis tool (versions prior to Dec 2012 update)
- Python zipfile.py library used by AndroGuard
- Security analyst workstations running APK analysis tooling
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Delivery: Malicious APK (Android/Wooboo family) is distributed for installation on Android devices
- Anti-Analysis: APK contains crafted 'link_size'/'link_off' padding values designed to crash AndroGuard/Python zipfile.py during static analysis
- Behavior Concealment: Malware manipulates search_methods() return values to hide sensitive behaviors such as audio/voice recording from analysts
- Data Collection: App reads device identifiers (IMEI for GSM, MEID/ESN for CDMA) and package name via Android APIs
- Evasion Success: Low AV detection rate (5 engines) at time of analysis due to analysis tooling being disrupted
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any YARA, Sigma, Snort/Suricata, or query-based detection rules. It references a patched version of zipfile.py (linked externally) as a mitigation for the analysis-tool crash issue rather than a detection rule.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | This is a static-analysis evasion technique targeting a specific security research tool (AndroGuard) rather than endpoint runtime behavior; standard EDR telemetry on Android devices would not typically observe this activity. |
| Network Visibility | None | The article describes no network indicators, C2 infrastructure, or network-based artifacts associated with this technique. |
| Detection Difficulty | Moderate | Detecting malformed APK structures designed to crash analysis tooling requires updated parsing libraries and awareness of the specific structural anomalies (e.g., unusual padding in zip local file headers); this is a tooling robustness issue rather than a signature-based detection problem. |
Required Log Sources
- Mobile threat analysis/sandbox logs (APK static analysis tool output/errors)
- Static analysis tool crash/error logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider investigating APK samples that consistently cause parsing tool crashes or unpack errors, as this may indicate deliberate anti-analysis structuring (MITRE T1497 - Virtualization/Sandbox Evasion). | APK static analysis tool logs, error/exception logs from zip parsing libraries | Defense Evasion | Medium - some crashes may result from genuinely malformed or corrupted APKs rather than intentional evasion |
| Consider reviewing APK samples where reflection or method-search based analysis functions return anomalous or empty results for sensitive API calls (e.g., MediaRecorder), which may indicate deliberate obfuscation of risky behavior (MITRE T1027). | Static analysis tool output logs comparing expected vs. actual method resolution results | Defense Evasion | Low to Medium - legitimate obfuscation or minification could also produce ambiguous results |
Control Gaps
- Outdated versions of AndroGuard or its Python zipfile dependency may fail to parse malicious APKs, resulting in incomplete or failed analysis rather than a clear malicious verdict.
- Signature-based mobile AV engines showed very low detection (5 engines) for the analyzed sample, indicating a broader gap in mobile malware detection coverage at the time.
Key Behavioral Indicators
- APK files causing repeated unpack/parsing failures in analysis tooling
- APKs containing unusual padding values in zip 'link_size'/'link_off' structures
- Discrepancies between expected and actual results from method-search based static analysis functions
False Positive Assessment
Medium - crashes in APK analysis tooling can result from either intentional malicious anti-analysis structuring or genuinely malformed/corrupted APK files, requiring manual verification to distinguish between the two.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting; consider updating AndroGuard and its Python zipfile dependency to the latest patched version to reduce analysis tool crashes.
- If your mobile malware analysis pipeline relies on AndroGuard, consider validating that APK samples causing parser crashes are flagged for manual review rather than discarded.
Infrastructure Hardening
- Consider maintaining analysis tooling (AndroGuard, Python libraries) on current patched versions as part of routine environment maintenance.
- Evaluate whether your mobile analysis sandbox includes multiple parsing engines to cross-validate APK structure analysis and reduce single-point evasion risk.
User Protection
- Consider ensuring mobile device management (MDM) or endpoint protection solutions on Android devices include up-to-date malware signatures capable of detecting Android/Wooboo and similar families.
- Where applicable, consider restricting installation of APKs from untrusted sources on managed devices.
Security Awareness
- Consider briefing analysts and threat researchers on the existence of anti-analysis techniques targeting common APK analysis tools so crashes are treated as a potential evasion signal rather than dismissed as tool bugs.
- Consider incorporating awareness of static-analysis evasion tactics into ongoing mobile threat research training programs.
MITRE ATT&CK Mapping
Execution
Additional IOCs
- File Hashes:
22ff8b141bc187095ded6a431073028c(MD5) - Sample of Android/Wooboo malware family that crashes AndroGuard's Python zipfile parsing via crafted padding values
