Add Quark malware analysis report for Chrysaor

[pulorsok]

Chrysaor Malware Family Analysis Report

This report analyses the Chrysaor malware family using Quark's rule classification. Chrysaor is the Android build of the Pegasus spyware developed by NSO Group, documented by Lookout and Google in 2017. It is delivered as a targeted implant that records audio, reads stored messages, and can remove its own traces on command. This run did not add a new rule for Chrysaor. Check here for the rule set details.

Quark's rule classification flagged 2 of 2 Chrysaor samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0316 Pegasus for Android software entry — Chrysaor is MITRE's alias for the same implant. Of the 14 techniques documented for the family, Quark's static bytecode analysis confirms the 2 listed below; see the coverage-gap notes at the end of this section for why the other 12 are not demonstrated here.

MITRE Technique	Real-world manifestation
T1429 Audio Capture	Recording ambient audio and phone calls for surveillance and intelligence gathering
T1422.001 Internet Connection Discovery	Checking whether the device currently has an active network connection

All behavior maps below were rendered from sample ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5.apk (package com.network.android) — chosen as the representative sample whose detected behaviors most fully cover the documented profile of Chrysaor. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1429 Audio Capture — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

Lcom/network/android/roomTap/AutoAnswerReceiver;c directly initializes the recorder and starts recording. This call enables the receiver to capture ambient audio without user interaction.

Behaviors detected by Quark:

• Initialize the recorder and start recording (Clean Up the Direct Use of MethodAnalysis (Sourcery refactored) #198)

2. T1422.001 Internet Connection Discovery

T1422.001 Internet Connection Discovery — attack.mitre.org

MITRE definition (T1422.001): Adversaries may check for Internet connectivity on compromised systems.

Lcom/network/f/a;a directly checks for network connectivity. This call enables the malware to determine whether an active network connection is available.

Behaviors detected by Quark:

• Check for network connectivity (Fix threshold filtering in the detailed mode. #224)

Coverage-gap notes

The 12 MITRE techniques documented for Chrysaor that this report does NOT demonstrate, grouped by the reason Quark could not confirm them:

What makes it malicious is in the text, not the call (2) — T1404 Exploitation for Privilege Escalation and T1636.002 Call Log. Lcom/network/android/m runs shell commands and Quark sees the call, but a shell call looks the same whatever it runs. T1636.002 fails the same way: the rules that fired cover the SMS and call-log providers together, because both are reached through one API with a different URI string.

The samples do not exhibit the behaviour (7) — T1409 Stored Application Data, T1418 Software Discovery, T1422 System Network Configuration Discovery, T1422.002 Wi-Fi Discovery, T1636.001 Calendar Entries, T1644 Out of Band Data and T1645 Compromise Client Software Binary. These samples do not carry these behaviours, so there is nothing for Quark to detect.

The two calls happen but nothing is passed between them (3) — T1512 Video Capture, T1624.001 Broadcast Receivers and T1636.003 Contact List. Each reaches stage 4: one method makes both calls, in the right order. The camera object, for one, travels through wrapper methods instead of going straight from the first call to the second, so Quark cannot link them.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	ADE8BEF0AC29FA363FC9AFD958AF0074478AEF650ADEB0318517B48BD996D5D5
2	BD8CDA80AAEE3E4A17E9967A1C062AC5C8E4AEFD7EAA3362F54044C2C94DB52A

---

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.48%. Comparing base (ac32d63) to head (092150b).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #968   +/-   ##
=======================================
  Coverage   78.48%   78.48%           
=======================================
  Files          84       84           
  Lines        7692     7692           
=======================================
  Hits         6037     6037           
  Misses       1655     1655           

Flag	Coverage Δ
unittests	78.48% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[haeter525]

LGTM