Androscope

Motivation

This is what Androscope is for. Searching malware by properties.

Home page of https://androscope.fortinet-cse.com

Main Links

How to submit a sample

Select Upload
Answer the captcha to be authorized to upload your sample
Select your sample (Choose File) and press Upload button
You get an extra warning if nobody knows your sample yet. This is fine, but please make sure you are uploading a malicious sample.
The automatic search automatically filled several fields for you. Check they are correct or modify, and if there are more to add, add new features you noticed for the sample.
Malicious features categories. Click on a category to deploy features.
For this particular sample, we specified 3 known names, a link to a malware analysis, and clicked on several features.
Click close to un-deploy a category. This does not submit the sample.
The automatic search had selected “calls phone numbers”, but for this sample, I believe it is only “calls a USSD code”. So, I de-selected the first property, and selected the last one.
Press Finished — Submit when you have finished and want to add the sample to Androscope’s database
Insert a sample to Androscope by its SHA256
This sample was inserted by SHA256. No sample, so no pre-analysis. You need to select features which apply in each category, and finally click on Finished-Submit.

Searching for a sample

Main page for searching samples in Androscope
In this case, I want to search for packed samples. So first I select the Packing category to deploy it. Then, I select the “Yes, it is packed” feature. If I want to search for a specific type of packer I can select it in the drop-down list, but by default, it will search for any packer. Then optionally click Close to undeploy the category and click “Finished-Submit” to search.
Example of search results
Your previous filters are memorized. If you don’t want this, click on the button “Clear search form”.

FAQ

This sample hasn’t been reviewed yet. Consequently it appears in gray and won’t be selected in Search.
If nothing else fits, use this field to specify a feature. You can also use that to drop a comment.

Feature details

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store