Skip to content

Detection Engines

Jump to bottom
Emirhan Uçan edited this page Jul 31, 2026 · 13 revisions

Detection Engines

Riskware Detections

Riskware.TestKey

Detection name: Riskware.TestKey

What it detects: Applications (APKs) that have been signed with Android debug/test certificates (commonly referred to as "testkey" signing). In the Android ecosystem, the AOSP build system ships several well-known test certificates (testkey, platform, shared, media) whose private keys are publicly available in the Android Open Source Project repository.

Why it matters: Any APK signed with a testkey certificate has been modified from its original signing — the original developer's signature has been replaced. This is a common technique used by:

  • Repackaged/modified apps distributed outside official app stores
  • Malware authors who modify legitimate apps to inject malicious code
  • Cracked/pirated applications
  • Unofficial builds that bypass the original signing process

Legitimate development builds on user devices are uncommon — most users run production-signed builds. The presence of a testkey signature on a user's device is a strong indicator that the app has been tampered with.

Default state: Disabled. This detection is disabled by default (TESTKEY_DETECTION_ENABLED = false) because some legitimate developer workflows involve testkey-signed builds. Users who want to flag testkey-signed applications must explicitly enable this rule via the app settings.

Implementation: Rust native module (hydradragonandroid/src/riskware.rs). The scanner extracts the X.509 signing certificate from META-INF/*.RSA/.DSA/.EC entries in the APK, computes its SHA-1 fingerprint, and compares it against a list of known AOSP test certificate fingerprints:

Certificate SHA-1 Fingerprint
testkey 61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81
platform E128AD41BA48B993EA696F801C36C7C41E1A9C6C
shared A9FE368A91C9EAB8187722C1C97FD35C959ED03E
media 3B1C59C13173A4A4C0E896AF3DF999568145D2FA

Java interface: NativeScanner.setRiskwareTestKeyEnabled(boolean enabled) — callable from Java to toggle the detection at runtime without engine reinitialization.

HydraDragonAV Mobile combines multiple scanning technologies to achieve comprehensive Android malware detection.

1. YARA-X (Native Rust)

  • Engine: Custom YARA-X fork with the hydradragon and dex modules, built with the pulley portable-interpreter backend. See YARA-X-Modules.
  • Modules: The hydradragon module provides per-app DNS/connection attribution (Android 10+), HIPS behavioral signals, and the static APK-analysis features (package/certificate/permission/activity — the former separate androguard module).
  • Rules: Extensive collection of YARA rules targeting Android malware families.
  • Method: Pattern-based rule matching with conditions and metadata.
  • Auto-generated rules: The native engine generates yarGen-style rules for confirmed malware, using AND-based multi-condition logic — package name (OR'd if multiple), DEX string pool threshold, and hydradragon.rootkit_behavior() — so all signals must align to match, reducing FPs.

2. ClamAV (Native Rust)

  • Integration: libclamav signatures compiled into the native Rust engine.
  • Database: Filtered by clam_juice.py to keep only Android-relevant platforms (Andr, Unix, Linux, Email, PUA) plus all Phishing signatures. Windows/OSX/Java signatures are excluded.
  • Method: Signature-based pattern matching.
  • File-type gate: Both ClamAV and YARA-X only run at all on a file confidently identified as APK/ZIP, DEX, ELF, HTML, ASCII text, PDF, or an image — desktop-only formats (PE, OLE2, Mail, Mach-O, SWF, Java) and files of an indeterminate type are skipped outright, not just rejected signature-by-signature. See ClamAV-Integration.

3. TLSH Fuzzy Hashing

  • Engine: Pure-Rust TLSH implementation (tlsh-rs).
  • Database: MalwareBazaar-derived TLSH digest database (APK/ELF/SO/DEX).
  • Method: Compares scanned files against known-malware digests to find similar-but-not-identical samples.

4. ML Detection

  • Burn Binary Classifier (hydradragonml): a pure-Rust Burn (wgpu) neural network — Embedding(20K→64) + mean-pool fused with 26 normalized engine features through an MLP → sigmoid — that scores every scanned APK. confidence >= 0.95 → malicious, >= 0.90 → suspicious. See AI-ML-Models.
  • AIEngine: Lightweight Java-side logistic-regression classifier (BIAS = -2.0) that scores DEX-level behavior from 8 boolean code-feature flags produced by CodeAnalyzer — obfuscation, dynamic loading, crypto/socket/shell APIs, adware SDKs. Corroboration-only — applied only when the native engine agrees (aiScore > 50 && activeFeatures >= 3). See Java-API-Reference.
  • MinHash/Jaccard benign whitelist (benign_db.rs): NOT the ML model — a fast benign-content skip that recognizes a known-benign APK by content (64-permutation MinHash, Jaccard ≥ 0.85) and skips the heavy ClamAV/ML/TLSH pass. The only MinHash in the codebase.

5. Malicious URL String Scanner

  • Method: Extracts every embedded http(s):// URL from raw bytes of scanned files (APK or otherwise).
  • Filter: Checks extracted URLs against native malware/phishing URL XOR filters.
  • Advantage: Full URL with path is far more specific than bare domain, reducing false positives.

6. NSRL-Backed Whitelisting

  • Dual layer: Binary-fuse XOR filter (in-memory, SHA-256 hashes) + SQLite database (full package metadata).
  • Purpose: Known-good software is never flagged. See NSRL-Whitelisting.

7. Native-Code Emulation (Unicorn Engine)

  • Engine: Unicorn CPU sandbox (ARM/ARM64/x86/x86_64).
  • Method: Runs embedded native library JNI_OnLoad/entry code in a bounded, syscall-free environment.
  • Purpose: Reveals runtime-decoded strings (e.g., C2 URLs) that never appear in static analysis.

Engine Comparison

Engine Type Speed False Positives Offline
YARA-X Pattern Rules Very Fast Low-Medium Yes
ClamAV Signatures Fast Very Low Yes
TLSH Fuzzy Hash Fast Low Yes
ML (Burn classifier) Neural Network Medium Low Yes
AIEngine Logistic Regression Fast Low-Medium Yes
URL Scanner XOR Filter Very Fast Very Low Yes
Unicorn CPU Emulation Slow Low Yes

Detection Flow

┌─────────────────────────────────────────────────────────────┐
│                    File / APK Scan Request                   │
└────────────────────────┬────────────────────────────────────┘
                         │
                    ┌────▼────┐
                    │  NSRL   │
                    │ Whitelist│
                    └────┬────┘
                         │ (if not whitelisted)
                    ┌────▼────┐
                    │  ML     │
                    │  Score  │
                    └────┬────┘
                  ┌──────┴──────┐
                  │             │
        confident benign   uncertain/malicious
                  │             │
                  │        ┌────▼────┐   ┌────▼────┐
                  │        │ YARA-X  │   │ ClamAV  │
                  │        │ Scan    │   │ Scan    │
                  │        └────┬────┘   └────┬────┘
                  │             │             │
                  │        ┌────▼────┐   ┌────▼────┐
                  │        │  TLSH   │   │Unicorn  │
                  │        │  Match  │   │Emulation│
                  │        └────┬────┘   └────┬────┘
                  │             │             │
          ┌───────┼─────────────┼─────────────┘
          │       │             │
     ┌────▼────┐  │        ┌────▼────┐
     │  Clean  │  │        │Malicious│
     │  Allow  │  │        │  Action │
     └─────────┘  │        └─────────┘
                  │
                  │  (suspicious alerts
                  │   from AIEngine)

See Also

Clone this wiki locally