Connect with us

Hi, what are you looking for?


Endpoint Security

Research Shows Many Security Products Fail to Detect Android Malware Variants

A group of academic researchers has created a tool that can be used to clone Android malware and test the resilience of these new variants against anti-malware detection.

A group of academic researchers has created a tool that can be used to clone Android malware and test the resilience of these new variants against anti-malware detection.

Called DroidMorph, the tool allows for the cloning of both malicious and benign applications by making modifications at different levels of abstraction. Testing against 17 commercial anti-malware engines has shown that half don’t detect the clones.

Implemented on top of the Soot Framework, the tool provides all of the necessary functionality for the generation of Android bytecode, as well as for modifying and analyzing it. The tool decompiles the APK, carries out the morphing, and then recompiles the modified code and signs the APK.

Researchers from the Adana Science and Technology University in Turkey and the National University of Science and Technology in Pakistan worked with a total of 848 samples pertaining to seven Android malware families, namely AnserverBot, BaseBridge, DroidKungFu3, DroidKungFu4, DroidDream, DroidDreamLight, and Geinimi.

They used DroidMorph to generate a total of 1,771 variants of these malware families, and then tested them for detection against 17 anti-malware engines in VirusTotal. The results showed that 8 of them were not able to detect any of the morphed APKs.

DroidMorph, the academics explain, implements morphing at three different levels of abstraction, namely body, class, and method. Of these, class morphing had the lowest average detection rate, mainly because it has more variants than all morphing.

The researchers also note that their tool only implements basic trivial and non-trivial obfuscations and that it needs additional work to improve morphing at different levels and further lower anti-malware detection rates. Morphing of meta-information embedded in the APK will also be added.

“The number of Android malware clones are on the rise and to stop this attack of clones we need to study how these clones are generated. We hope that DroidMorph will be used in future research, to improve Android malware clones analysis and detection, and help stop them,” the researchers note.

Advertisement. Scroll to continue reading.

Related: Flaws in Apple Location Tracking System Could Lead to User Identification

Related: Research: Security Agencies Expose Information via Improperly Sanitized PDFs

Related: Academics Devise Attacks Targeting Email End-to-End Encryption

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.