[Analyzer] MobSF_Service

[mlodic]

Name

MobSF_Service

Link

https://github.com/MobSF/mobsfscan

Type of analyzer

file analysis for APK.

Why should we use it

We already have a MobSF analyzer for static analysis only of source code elements of an APK.
We want to add support for the Mob_SF APIs, for ones that have the engine available as a service and wants to launch a static or dynamic analysis programmatically at scale.

Optional: it could make sense to add a MOBSF framework as an optional docker container and let it to be used by IntelOwl

Possible implementation

API docs can be found in the GUI of the project once you install it. http://localhost:8000/api_docs

[spoiicy]

Hi @mlodic can I take this up?

[spoiicy]

@mlodic After going through the MobSF documentation, I've concluded that implementing Static Analysis would be easy but I want to know what are your thoughts on Dynamic Analysis by MobSF, since it's not a fully automated dynamic analysis instead it's a semi-automatic one which will require manual intervention as well e.g the use of Frida scripts
Ref: https://mobsf.live/api_docs
Also in dynamic analysis, we'll have to hit "stop_analysis" endpoint to end the analysis and then we'll be able to generate the json report. How are we deciding when to stop.
Since there are too many variables at play, how do we implement mobsf in such a way that we get the maximum results without any manual intervention because the simple dynamic analysis results are not insightful at all.

Let me know what you think?

[mlodic]

About the dynamic analysis, you can ignore the "manual" commands and just execute start and stop after a configurable parameter (I would say 2-3 minutes by default).

the simple dynamic analysis results are not insightful at all.

Why do you say that? Can you bring me some example of valid reports and their unuseleness?

Then I underline how IntelOwl has implemented similar mechanisms for other malware analysis services and that is pretty normal. IntelOwl's goal is to provide tools for scaling the analysis so it's perfectly fine if the results are not comprehensive. In real life, an analyst would pivot from interesting automated analysis and do their own analysis starting from the automated one