Add Quark malware analysis report for Herodotus

[aiden00713]

Herodotus Malware Family Analysis Report

This report analyses the Herodotus malware family using Quark's rule classification. Herodotus is an Android banking trojan first reported by ThreatFabric in 2025. It is built for device takeover, sold as malware-as-a-service, and distributed through side-loading, potentially involving SMS phishing (smishing) links that lead to a dropper, which then installs a separate payload. Both samples analysed here were downloaded from MalwareBazaar, where they carry the signature "Herodotus". In the two samples tested here, Quark confirms code that queries device data through ContentResolver. This run did not add a new rule for Herodotus. Check here for the rule set details.

Quark's rule classification flagged 2 of 2 Herodotus samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy. MITRE ATT&CK has no software entry for Herodotus in this run's records, and the technique list did not come from ThreatFabric. It came from the MITRE entry for SpyNote RAT (S0305), which this run's threat-intelligence step associated with Herodotus because several VirusTotal verdicts for the samples name SpyNote. That association is not used anywhere else in this report, and the list should not be read as Herodotus's documented profile. Of the 6 techniques in that entry, 5 could be matched to at least one Quark rule and were evaluated. Of those 5 techniques, Quark's static bytecode analysis confirms the 1 listed below; see the coverage-gap notes at the end of this section for the other 4.

MITRE Technique	Real-world manifestation
T1533 Data from Local System	Querying device data through a content provider

All behavior maps below were rendered from sample 78533e66970f86f2a8f583b40a54c5c4a70afadda811ace35cd7380352765b1b.apk (package sruddRsS.RmRCrBNLwB.ymVWwbF). Both samples matched T1533, and this run picked this one as the representative sample. The other family sample was used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.

1. T1533 Data From Local System

T1533 Data from Local System — attack.mitre.org

MITRE definition (T1533): Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges.

LsruddRsS/RmRCrBNLwB/ymVWwbF/xvhojmxrnmdcug;i calls two helper methods. LsruddRsS/RmRCrBNLwB/ymVWwbF/xvhojmxrnmdcug;E queries device data through ContentResolver and checks the result; this query is the T1533 evidence. The rules do not show which content provider it reads, so the data is described here only as device data. ;i itself and its other helper, LsruddRsS/RmRCrBNLwB/ymVWwbF/xvhojmxrnmdcug;e0, each read a resource file bundled in the app's own res/raw directory. Reading the app's own resources is not T1533, so those two rules are listed for completeness only.

Behaviors detected by Quark:

• Get resource file from res/raw directory (Auto-Generated Python Documentation with Sphinx #36)
• Read sensitive data(SMS, CALLLOG, etc) (UnicodeEncodeError: 'gbk' codec can't encode character '\u037d' #77)
• Query a URI and check the result (fix prompt-toolkit version #187)
• Query device data with ContentResolver (Add an Optional Parameter Filter For JSON Rules #212)

Coverage-gap notes

The 4 MITRE techniques evaluated for Herodotus that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:

No related rule matched (3) — T1429 Audio Capture, T1636.003 Contact List and T1624.001 Broadcast Receivers.

• T1429 Audio Capture: 14 related rules were tested, and none matched in either sample. The recording APIs used by the recorded example rules do not appear in the samples.
• T1636.003 Contact List: 2 related rules were tested, and neither matched in either sample. The samples never use the required APIs together.
• T1624.001 Broadcast Receivers: 8 related rules were tested, and none matched in either sample. The closest, "Monitor device boot completion" (Update version to 21.10.2 #262), finds the two calls in one method, but no data passes between them.

The only match was too generic (1) — T1636.004 SMS Messages. 12 related rules were tested. The only behavior Quark matched was a generic intent-action check, "Monitor the general action to be performed" (#25), which does not show SMS messages being read.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	78533E66970F86F2A8F583B40A54C5C4A70AFADDA811ACE35CD7380352765B1B
2	E084A327FDE5523B1803040FC1EA40BE84BC8434913D37D01083890C351DEC96

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.28%. Comparing base (8b1a7c3) to head (809c0d5).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #983   +/-   ##
=======================================
  Coverage   81.28%   81.28%           
=======================================
  Files          84       84           
  Lines        7923     7923           
=======================================
  Hits         6440     6440           
  Misses       1483     1483           

Flag	Coverage Δ
unittests	81.28% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[haeter525]

LGTM