Add Quark malware analysis report for Skygofree

docs/source/malware_report.rst

@@ -3482,3 +3482,127 @@ The table below lists the APKs we tested.
 +-------+------------------------------------------------------------------+
 | 3     | E6E736DF1923C47F6624DAB18BF6A341995B5E756395256AA0B3F4C43594481A |
 +-------+------------------------------------------------------------------+
+
+Skygofree Malware Family Analysis Report
+========================================
+
+This report analyses `Skygofree <https://malpedia.caad.fkie.fraunhofer.de/details/apk.skygofree>`__ malware family using Quark's rule classification. Skygofree is a multi-stage Android surveillance implant documented by Kaspersky in 2018 and attributed to an Italian IT company selling offensive software. It is delivered through fake mobile-operator pages and, once installed, records audio and video on command, steals files from messaging applications, and downloads further modules from its command and control server. This run did not generate a new rule for Skygofree: the family's surveillance primitives are already covered by Quark's existing rule set. Check `here <https://github.com/quark-engine/quark-rules>`__ for the rule set details.
+
+Quark's rule classification flagged **2 of 2 Skygofree samples** as high-risk in this experiment (detection rate **100%**). Benign-cohort false-positive rate was not measured here. Please check :ref:`here <list-of-tested-apks-skygofree>` for the APKs we tested.
+
+Identified Well-Known Threats
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The behaviours below are referenced from `MITRE ATT&CK® Mobile — S0327 Skygofree <https://attack.mitre.org/software/S0327>`__.
+
+This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the `S0327 Skygofree <https://attack.mitre.org/software/S0327>`__ software entry. Of the **8 techniques** documented for the family, Quark's static bytecode analysis surfaces the **4 listed below**; see the coverage-gap notes at the end of this section for why the other 4 are not demonstrated here.
+
+.. list-table::
+   :header-rows: 1
+   :widths: 30 70
+
+   * - MITRE Technique
+     - Real-world manifestation
+   * - T1429 Audio Capture
+     - Recording ambient audio and phone calls when device enters specific locations
+   * - T1409 Stored Application Data
+     - Stealing message databases and files belonging to other installed applications
+   * - T1407 Download New Code at Runtime
+     - Fetching additional surveillance modules from command and control infrastructure on demand
+   * - T1512 Video Capture
+     - Recording video through device cameras triggered by attacker commands or conditions
+
+All behavior maps below were rendered from sample ``e6aba7629608a525b020f4e76e4694d6d478dd9561d934813004b6903d66e44c.apk`` (package ``com.sysmanager``) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Skygofree. The other family sample was used to compute the detection-rate figure above.
+
+Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.
+
+**1. T1429 Audio Capture**
+
+`T1429 Audio Capture — attack.mitre.org <https://attack.mitre.org/techniques/T1429>`__
+
+    **MITRE definition (T1429):** Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.
+
+.. image:: https://i.ibb.co/7NxDBrWZ/t1429-audio-capture.png
+
+`startRecording` directly initializes the recorder and starts recording audio. This call enables the service to capture ambient sound from the device microphone.
+
+Behaviors detected by Quark:
+
+* Initialize the recorder and start recording (#00198)
+
+**2. T1409 Stored Application Data**
+
+`T1409 Stored Application Data — attack.mitre.org <https://attack.mitre.org/techniques/T1409>`__
+
+    **MITRE definition (T1409):** Adversaries may try to access and collect application data resident on the device.
+
+.. image:: https://i.ibb.co/V00MgYR0/t1409-stored-application-data.png
+
+`run` calls one helper to read files into streams, retrieve absolute paths, and package file data into JSON objects. Together, these calls enable the malware to access application data files and prepare them for upload.
+
+Behaviors detected by Quark:
+
+* Read file and put it into a stream (#00013)
+* Read file into a stream and put it into a JSON object (#00014)
+* Get absolute path of the file and store in string (#00020)
+* Open a file from given absolute path of the file (#00022)
+
+**3. T1407 Download New Code at Runtime**
+
+`T1407 Download New Code at Runtime — attack.mitre.org <https://attack.mitre.org/techniques/T1407>`__
+
+    **MITRE definition (T1407):** Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores.
+
+.. image:: https://i.ibb.co/67CVJM1L/t1407-download-new-code-at-runtime.png
+
+`doInBackground` calls one helper to write HTTP input streams to disk and install APKs from those files. Together, these calls enable the malware to download and install additional applications at runtime.
+
+Behaviors detected by Quark:
+
+* Install other APKs from file (#00054)
+* Write HTTP input stream into a file (#00072)
+
+**4. T1512 Video Capture**
+
+`T1512 Video Capture — attack.mitre.org <https://attack.mitre.org/techniques/T1512>`__
+
+    **MITRE definition (T1512):** An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with the device cameras through an available API provided by the operating system.
+
+.. image:: https://i.ibb.co/21BVMdt0/t1512-video-capture.png
+
+`takePic` directly configures camera parameters, sets the preview texture, and starts capturing preview frames to the screen. Together, these calls enable the malware to activate the camera and capture visual data.
+
+Behaviors detected by Quark:
+
+* Get current camera paremeters and change the setting. (#00183)
+* Set camera preview texture (#00184)
+* Start capturing camera preview frames to the screen (#00185)
+
+**Coverage-gap notes**
+
+The 4 MITRE techniques documented for Skygofree that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:
+
+**The evidence Quark collected does not demonstrate the technique (2)** — T1404 Exploitation for Privilege Escalation and T1644 Out of Band Data.
+
+For T1404, sample ``af848999…`` downloads a program from its server and runs it through a shell to gain root, in ``Lcore/syncsystem/methods/Priv$2;run``. Quark does reach that code and fires "Executes the specified string Linux command", because ``Runtime.exec`` is an API it can match. The shell command itself, though, is assembled at runtime and handed to ``exec`` as a string argument — ``Runtime.exec(["/system/bin/sh", "-c", <command>])`` — and Quark's rules match API calls, not the strings passed to them. Quark therefore sees that a command ran but never which one, so running an exploit and listing a directory look identical to it.
+
+For T1644, Quark did cluster SMS handling in ``Lcom/sysmanager/system/SmsReceiver;onReceive``, but that cluster reads and filters incoming messages. T1644 requires receiving command and control instructions over binary SMS, which the collected primitives do not show.
+
+**Both APIs are present, but no single method passes data between them (1)** — T1430 Location Tracking. Quark's rules for this technique pair ``Location.getLatitude`` with ``Location.getLongitude``. Both APIs exist in the samples and Quark reaches stage 3, but no method calls both and passes a value from one to the other, so the match stops short of the data-flow stage that a confirmed detection requires.
+
+**The behavior is real but not separable from a technique already shown (1)** — T1437.001 Web Protocols. Skygofree's HTTP command and control traffic is genuine, and Quark confirms it inside ``Lcom/sysmanager/network/`` classes such as ``GetCommands`` and ``StartReverse``. The primitives collected there — open a URL, set a request method, read the response stream — are the generic transport that T1407's download step already rests on, rather than evidence specific to command and control signalling, so no separate cluster was attributed to this technique.
+
+.. _list-of-tested-apks-skygofree:
+
+List of Tested APKs
+~~~~~~~~~~~~~~~~~~~
+
+The table below lists the APKs we tested.
+
++-------+------------------------------------------------------------------+
+| index | sha256                                                           |
++=======+==================================================================+
+| 1     | AF848999A4B8DF0E33F5A05A618C83D1F3052D4026AB77B2ACF66DEF71DF754E |
++-------+------------------------------------------------------------------+
+| 2     | E6ABA7629608A525B020F4E76E4694D6D478DD9561D934813004B6903D66E44C |
++-------+------------------------------------------------------------------+