sync: update apk intelligence, identity, risk fusion logic, and YARA rules from backend

app/services/apk_intelligence/analyzer.py

@@ -252,6 +252,9 @@ class APKAnalyzer:
                 engine_results=engine_results,
                 local_risk=metadata.localRisk,
                 package_name=metadata.packageName,
+                certificate_hash=metadata.certificateHash,
+                app_name=metadata.appName,
+                installer_package_name=metadata.installerPackageName,
             )
 
             response.explanation = run_threat_explanation(engine_results, response)

app/services/apk_intelligence/engines/androguard_engine.py

@@ -51,6 +51,35 @@ _SUSPICIOUS_RECEIVER_ACTIONS = frozenset({
 
 _ANDROID_NS = "http://schemas.android.com/apk/res/android"
 
+# ---------------------------------------------------------------------------
+# Patch androguard's DIMENSION_UNITS to cover all 16 unit indices that
+# COMPLEX_UNIT_MASK (0x0F) can produce.  Upstream only defines 6 entries
+# (px/dip/sp/pt/in/mm).  Packed or obfuscated APKs often have resource
+# entries with unit indices 6–15, which causes an IndexError inside
+# get_resource_dimen → a DEBUG log storm.  Extending the list with
+# placeholder names makes the lookup always succeed.
+# ---------------------------------------------------------------------------
+def _patch_androguard_dimension_units() -> None:
+    try:
+        import androguard.core.axml as _axml  # type: ignore[import-untyped]
+
+        _UNIT_MASK = 0x0F  # COMPLEX_UNIT_MASK — max possible index is 15
+        _needed = _UNIT_MASK + 1  # 16 entries
+        _shortfall = _needed - len(_axml.DIMENSION_UNITS)
+        if _shortfall > 0:
+            for _i in range(len(_axml.DIMENSION_UNITS), _needed):
+                _axml.DIMENSION_UNITS.append(f"unknown_unit{_i}")
+            logger.debug(
+                "Patched androguard DIMENSION_UNITS: added %d placeholder unit(s) "
+                "to prevent IndexError on non-standard APK resource tables.",
+                _shortfall,
+            )
+    except Exception:
+        pass  # androguard not installed — nothing to patch
+
+
+_patch_androguard_dimension_units()
+
 
 class AndroguardEngine:
     """
@@ -108,6 +137,9 @@ class AndroguardEngine:
 
         try:
             apk = APK(str(apk_path))
+            if not apk.is_valid_APK():
+                logger.warning("Androguard: invalid APK or cannot parse manifest for %s", apk_path)
+                return AndroguardResult(error="Invalid APK: Failed to parse AndroidManifest.xml")
         except Exception as exc:
             logger.warning("Androguard: cannot parse %s — %s", apk_path, exc)
             return AndroguardResult(error=f"Invalid APK: {exc}")
@@ -123,10 +155,14 @@ class AndroguardEngine:
         perm_set = set(permissions)
         is_obfuscated = _has_obfuscated_names(components)
         native_code = bool(list(apk.get_libraries()))
-        dynamic_code_loading = (
-            "android.permission.REQUEST_INSTALL_PACKAGES" in perm_set
-            or sum(1 for _ in apk.get_dex_names()) > 1
-        )
+        # Actual dynamic code loading — DexClassLoader fetches and executes code
+        # from an arbitrary file/byte array at runtime. This used to be approximated
+        # by the REQUEST_INSTALL_PACKAGES permission, which is wrong: that permission
+        # is for self-update/in-app-install flows (Spotify, Instagram both hold it)
+        # and has nothing to do with loading code dynamically. PathClassLoader is
+        # deliberately excluded — it's the default loader for every app's own code
+        # since Android 5.0, so its presence is universal and not a signal at all.
+        dynamic_code_loading = _has_dex_class_loader(apk)
 
         logger.info(
             "Androguard: pkg=%s perms=%d activities=%d services=%d receivers=%d "
@@ -166,6 +202,9 @@ class AndroguardEngine:
                 self._cert_sha256_from_der(cert_der) if cert_der else self._extract_cert_sha256(apk)
             ),
             certificate_intel=self._build_certificate_intel(cert_der),
+            min_sdk_version=_safe_int(_safe_call(apk.get_min_sdk_version)),
+            target_sdk_version=_safe_int(_safe_call(apk.get_target_sdk_version)),
+            main_activity=_safe_call(apk.get_main_activity) or None,
         )
 
     def _get_cert_der(self, apk) -> Optional[bytes]:
@@ -394,6 +433,13 @@ def _safe_str(val: object) -> str:
     return str(val) if val is not None else ""
 
 
+def _safe_int(val: object) -> Optional[int]:
+    try:
+        return int(val) if val is not None else None
+    except (TypeError, ValueError):
+        return None
+
+
 def _has_obfuscated_names(components: ApkComponents) -> bool:
     """True if any component name ends with a 1-2 character class segment."""
     all_names = components.activities + components.services + components.receivers
@@ -404,6 +450,24 @@ def _has_obfuscated_names(components: ApkComponents) -> bool:
     return False
 
 
+def _has_dex_class_loader(apk: object) -> bool:
+    """True if the APK's DEX bytecode references DexClassLoader/InMemoryDexClassLoader
+    — the loaders apps use to fetch and execute code from an arbitrary source at
+    runtime. PathClassLoader is intentionally not checked here (see caller comment)."""
+    try:
+        get_all_dex = getattr(apk, "get_all_dex", None)
+        dex_blobs = list(get_all_dex()) if callable(get_all_dex) else [apk.get_dex()]
+    except Exception:
+        return False
+
+    for blob in dex_blobs:
+        if not blob:
+            continue
+        if b"DexClassLoader" in blob:
+            return True
+    return False
+
+
 def _build_ml_features(
     permissions: list[str],
     components: ApkComponents,

app/services/apk_intelligence/engines/apkid_engine.py

@@ -59,24 +59,22 @@ _OBFUSCATOR_SIGS: list[tuple[str, bytes]] = [
 ]
 
 _ANTI_ANALYSIS_SIGS: list[tuple[str, bytes]] = [
+    # "ro.product.model", "ro.hardware", and "android.os.build"/"android.os.debug"
+    # were dropped — they're just the Build/Debug API surface used by virtually
+    # every app for device-info logging and analytics, not evidence of deliberate
+    # evasion. Keep only strings that specifically name an evasion technique or
+    # a specific emulator/VM/instrumentation product.
     ("emulator-check",  b"isemulator"),
-    ("emulator-check",  b"ro.product.model"),
-    ("emulator-check",  b"ro.hardware"),
     ("emulator-check",  b"goldfish"),
     ("emulator-check",  b"vbox86"),
-    ("emulator-check",  b"android.os.build"),
     ("debugger-check",  b"isdebuggerconnected"),
-    ("debugger-check",  b"android.os.debug"),
     ("debugger-check",  b"jdwp"),
     ("anti-vm",         b"vmware"),
     ("anti-vm",         b"virtualbox"),
     ("anti-vm",         b"bluestacks"),
     ("anti-vm",         b"noxplayer"),
-    ("anti-frida",      b"frida"),
     ("anti-frida",      b"frida-gadget"),
     ("anti-frida",      b"gum-js-loop"),
-    ("anti-frida",      b"frida_"),
-    ("root-check",      b"busybox"),
     ("root-check",      b"/system/xbin/su"),
 ]
 
@@ -220,14 +218,23 @@ def _build_result(
     if packers:
         score += 0.4
 
-    if anti_analysis:
+    # A single anti-analysis category (e.g. just a debugger-state check used for
+    # crash-reporting telemetry) is common in legitimate hardened release builds.
+    # An evasion *suite* — multiple distinct categories together (anti-emulator +
+    # anti-debug + anti-frida etc.) — is the real signal genuine malware exhibits
+    # to survive sandbox/dynamic analysis.
+    if len(anti_analysis) > 1:
         score += 0.3
+    elif anti_analysis:
+        score += 0.05
 
-    # "heavy" obfuscation = more than one obfuscator tool detected
+    # ProGuard/R8 is the default release-hardening toolchain for virtually all
+    # production Android apps — "heavy" obfuscation (multiple distinct tools
+    # stacked together) is the unusual, more suspicious case.
     if len(obfuscators) > 1:
         score += 0.2
     elif obfuscators:
-        score += 0.1  # single obfuscator is common in legitimate apps
+        score += 0.02
 
     risk_score = round(min(score, 1.0), 4)
 

app/services/apk_intelligence/engines/ml_engine.py

@@ -114,9 +114,13 @@ class MLFeatureExtractor:
         perm_location = 1.0 if _PERM_LOCATION    in perm_set else 0.0
 
         # ── Component features ─────────────────────────────────────────────────
-        receiver_count  = float(len(comp.receivers)  if comp else 0)
-        service_count   = float(len(comp.services)   if comp else 0)
-        exported_count  = float(sf.exported_count    if sf   else 0)
+        # Clamp raw counts before weighting — large legitimate apps routinely
+        # ship dozens of activities/services/receivers, which would otherwise
+        # rack up score purely from being feature-rich rather than malicious.
+        _COMPONENT_COUNT_CAP = 5.0
+        receiver_count  = min(float(len(comp.receivers)  if comp else 0), _COMPONENT_COUNT_CAP)
+        service_count   = min(float(len(comp.services)   if comp else 0), _COMPONENT_COUNT_CAP)
+        exported_count  = min(float(sf.exported_count    if sf   else 0), _COMPONENT_COUNT_CAP)
 
         # ── Behaviour features ─────────────────────────────────────────────────
         sms_access    = 1.0 if sf and sf.sms_access            else 0.0

app/services/apk_intelligence/engines/reverse_engineering_engine.py

@@ -28,6 +28,7 @@ from app.services.apk_intelligence.engines.apkid_engine import _PACKER_SIGS
 from app.services.apk_intelligence.models import (
     AndroguardResult,
     CapabilityFinding,
+    IOCSet,
     NetworkIndicator,
     ReverseEngineeringResult,
 )
@@ -119,6 +120,22 @@ _IGNORED_IPS = frozenset({"0.0.0.0", "127.0.0.1", "255.255.255.255"})
 _PASTEBIN_RAW_RE = re.compile(rb"pastebin\.com/raw/", re.IGNORECASE)
 _TELEGRAM_BOT_RE = re.compile(rb"api\.telegram\.org/bot", re.IGNORECASE)
 
+# ── IOC extraction (emails, crypto constants, Firebase) ────────────────────────
+
+_MAX_IOCS_PER_CATEGORY = 10
+
+_EMAIL_RE = re.compile(rb"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b")
+_CRYPTO_RE = re.compile(
+    rb"\b(AES|DES|3DES|TripleDES|RSA|Blowfish|RC4|ChaCha20|HMAC-?SHA(?:1|256)?)\b",
+    re.IGNORECASE,
+)
+_FIREBASE_MARKERS = (
+    b".firebaseio.com",
+    b".firebaseapp.com",
+    b"firebasestorage.googleapis.com",
+    b"firebase-settings.crashlytics.com",
+)
+
 
 def _confidence(n_hits: int, has_corroboration: bool) -> Optional[str]:
     """HIGH = >=2 signature hits AND a corroborating permission/flag.
@@ -132,10 +149,12 @@ def _confidence(n_hits: int, has_corroboration: bool) -> Optional[str]:
 
 def _confidence_no_corroboration(n_hits: int) -> Optional[str]:
     """For capabilities with no manifest-level corroborating signal:
-    HIGH = >=3 hits, MEDIUM = >=1 hit."""
-    if n_hits >= 3:
+    HIGH = >=4 hits, MEDIUM = >=2 hits. A single common API string (e.g.
+    "loadurl", "jobscheduler") is too common in ordinary apps to mean
+    anything on its own."""
+    if n_hits >= 4:
         return "HIGH"
-    if n_hits >= 1:
+    if n_hits >= 2:
         return "MEDIUM"
     return None
 
@@ -185,7 +204,7 @@ class ReverseEngineeringEngine:
             self._find_overlay_phishing(buf_lower, perms),
             self._find_remote_access(buf_lower),
             self._find_accessibility_abuse(buf_lower, perms),
-            self._find_credential_harvesting(buf_lower),
+            self._find_credential_harvesting(buf_lower, perms),
             self._find_dynamic_code_loading(buf_lower, androguard),
             self._find_persistence(buf_lower, perms),
         ]
@@ -199,12 +218,14 @@ class ReverseEngineeringEngine:
         capabilities = [f for f in findings if f is not None]
 
         certificate = androguard.identity.certificate_intel if androguard.identity else None
+        iocs = self._extract_iocs(buf, network_indicators)
 
         return ReverseEngineeringResult(
             capabilities=capabilities,
             native_libraries=native_libraries,
             network_indicators=network_indicators,
             certificate=certificate,
+            iocs=iocs,
         )
 
     # ── Scan buffer (mirrors yara_engine._extract_scan_buffer) ────────────────────
@@ -339,11 +360,20 @@ class ReverseEngineeringEngine:
             mitre_id="T1418",
         )
 
-    def _find_credential_harvesting(self, buf: bytes) -> Optional[CapabilityFinding]:
+    def _find_credential_harvesting(self, buf: bytes, perms: FrozenSet[str]) -> Optional[CapabilityFinding]:
         n, hits = self._count_hits(buf, _CREDENTIAL_HARVESTING_SIGS)
-        confidence = _confidence_no_corroboration(n)
+        # All 4 signatures here (addJavascriptInterface, setJavascriptEnabled,
+        # passwordTransformationMethod, loadUrl) are bog-standard APIs for any
+        # WebView-based OAuth/payment login screen — confirmed false-positive HIGH
+        # on Google Docs, Instagram, Spotify, and an unrelated Flutter hackathon app,
+        # none of which harvest credentials. Genuine overlay-phishing credential theft
+        # specifically needs to draw its fake form *over* another app, so require the
+        # overlay permission as corroboration rather than trusting the bare hit count.
+        has_perm = _OVERLAY_PERM in perms
+        confidence = _confidence(n, has_perm)
         if confidence is None:
             return None
+        evidence = hits[:5] + ([_OVERLAY_PERM] if has_perm else [])
         return CapabilityFinding(
             capability_id="credential_harvesting",
             name="Credential Harvesting via WebView",
@@ -354,7 +384,7 @@ class ReverseEngineeringEngine:
                 "usernames and passwords."
             ),
             confidence=confidence,
-            evidence=hits[:5],
+            evidence=evidence[:6],
             mitre_id="T1417",
         )
 
@@ -498,6 +528,38 @@ class ReverseEngineeringEngine:
 
         return indicators
 
+    def _extract_iocs(self, buf: bytes, network_indicators: list[NetworkIndicator]) -> IOCSet:
+        """Categorize already-extracted network indicators plus independently
+        regex emails/crypto constants/Firebase markers — reuses the
+        domain/url/ip pass already done by _extract_network_indicators."""
+        domains = [i.value for i in network_indicators if i.type == "domain"][:_MAX_IOCS_PER_CATEGORY]
+        urls = [i.value for i in network_indicators if i.type == "url"][:_MAX_IOCS_PER_CATEGORY]
+        ips = [i.value for i in network_indicators if i.type == "ip"][:_MAX_IOCS_PER_CATEGORY]
+
+        emails = sorted({
+            m.group().decode("ascii", errors="ignore")
+            for m in _EMAIL_RE.finditer(buf)
+        })[:_MAX_IOCS_PER_CATEGORY]
+
+        crypto_constants = sorted({
+            m.group().decode("ascii", errors="ignore").upper()
+            for m in _CRYPTO_RE.finditer(buf)
+        })[:_MAX_IOCS_PER_CATEGORY]
+
+        firebase_urls = sorted({
+            url for url in (i.value for i in network_indicators if i.type == "url")
+            if any(marker in url.lower().encode() for marker in _FIREBASE_MARKERS)
+        })[:_MAX_IOCS_PER_CATEGORY]
+
+        return IOCSet(
+            domains=domains,
+            urls=urls,
+            ips=ips,
+            emails=emails,
+            firebase_urls=firebase_urls,
+            crypto_constants=crypto_constants,
+        )
+
     def _find_suspicious_network(self, indicators: list[NetworkIndicator]) -> Optional[CapabilityFinding]:
         flagged = [i for i in indicators if i.context]
         if len(flagged) >= 2:

app/services/apk_intelligence/models.py

@@ -49,6 +49,13 @@ class ApkAnalysisRequest(BaseModel):
     certificateHash: Optional[str] = Field(None, description="SHA-256 of the signing certificate (hex)")
     permissions: List[str] = Field(default_factory=list, description="Permissions declared in the APK manifest")
     localRisk: float = Field(0.0, ge=0.0, le=100.0, description="Local risk score (0–100) from the SDK")
+    installerPackageName: Optional[str] = Field(
+        None,
+        description="Package name of the app that installed this APK (e.g. com.android.vending "
+                    "for Play Store), via PackageManager.getInstallSourceInfo/getInstallerPackageName. "
+                    "Null for not-yet-installed files — Android only records install-source "
+                    "attribution for already-installed packages.",
+    )
 
     @field_validator("permissions", mode="before")
     @classmethod

app/services/apk_intelligence/threat_explainer.py

@@ -910,8 +910,15 @@ class ThreatExplanationEngine:
 
         re_result = r.reverse_engineering
 
+        # Only escalate HIGH-confidence reverse-engineering findings into named
+        # attack-pattern vectors (and therefore the STIX/UI bundle). MEDIUM
+        # findings stay available on the raw scan result, but a single common
+        # API string (e.g. "loadurl", "jobscheduler") isn't enough corroboration
+        # to label an app with a MITRE attack pattern — this mirrors the
+        # HIGH-only gating already used in risk/fusion.py's _compute_confidence
+        # and in _classify_threat above.
         remote_access = self._find_capability(re_result, "remote_access")
-        if remote_access:
+        if remote_access and remote_access.confidence == "HIGH":
             mid, mname = _MITRE["remote_access"]
             vectors.append(AttackVector(
                 name="Remote Access / Screen Streaming",
@@ -922,7 +929,7 @@ class ThreatExplanationEngine:
             ))
 
         persistence = self._find_capability(re_result, "persistence")
-        if persistence:
+        if persistence and persistence.confidence == "HIGH":
             mid, mname = _MITRE["persistence"]
             vectors.append(AttackVector(
                 name="Persistence via Boot Receiver / Scheduled Tasks",
@@ -933,7 +940,7 @@ class ThreatExplanationEngine:
             ))
 
         suspicious_network = self._find_capability(re_result, "suspicious_network")
-        if suspicious_network:
+        if suspicious_network and suspicious_network.confidence == "HIGH":
             mid, mname = _MITRE["suspicious_network"]
             vectors.append(AttackVector(
                 name="Command-and-Control Communication",
@@ -944,7 +951,7 @@ class ThreatExplanationEngine:
             ))
 
         credential_harvesting = self._find_capability(re_result, "credential_harvesting")
-        if credential_harvesting:
+        if credential_harvesting and credential_harvesting.confidence == "HIGH":
             mid, mname = _MITRE["credential_theft"]
             vectors.append(AttackVector(
                 name="Credential Harvesting via WebView Injection",
@@ -955,7 +962,7 @@ class ThreatExplanationEngine:
             ))
 
         native_code_hiding = self._find_capability(re_result, "native_code_hiding")
-        if native_code_hiding:
+        if native_code_hiding and native_code_hiding.confidence == "HIGH":
             mid, mname = _MITRE["packer"]
             vectors.append(AttackVector(
                 name="Native Code Obfuscation",

app/services/identity/bank_registry.py

@@ -158,3 +158,23 @@ def find_bank_by_display_name(display_name: str) -> Optional[BankAppProfile]:
 def all_official_packages() -> set[str]:
     """Return the complete set of all known official bank package names."""
     return set(_PACKAGE_TO_BANK.keys())
+
+
+# ── Brand-keyword detection (coarser net than name-similarity/squatting) ───────
+# Catches cases like "SBI Quick Pay Helper" that don't score high enough on
+# difflib similarity against "YONO SBI" but still trade on a banking brand
+# without being a recognized official banking app.
+_BRAND_KEYWORDS: tuple[str, ...] = (
+    "sbi", "yono", "hdfc", "icici", "axis bank", "kotak",
+    "pnb", "bank of baroda", "canara bank", "union bank",
+    "indian bank", "kyc update", "kyc verification",
+)
+
+
+def find_brand_keyword(text: str) -> Optional[str]:
+    """Return the matched banking-brand keyword if `text` contains one, else None."""
+    normalised = text.lower()
+    for keyword in _BRAND_KEYWORDS:
+        if keyword in normalised:
+            return keyword
+    return None

app/services/identity/trusted_publisher_registry.py

@@ -0,0 +1,125 @@
+"""
+identity/trusted_publisher_registry.py
+— Registry of well-known, non-banking app publishers and their signing certificates.
+
+Used by risk/fusion.py to apply a trust discount when an APK's package name AND
+signing certificate both match a known-good publisher. This is what stops a
+signed Instagram/Spotify/Google Docs build — which legitimately holds SMS,
+camera, contacts, and self-update capabilities — from being scored the same
+way as an unsigned/unknown APK that holds the exact same capabilities.
+
+This is a capability allowlist by *identity*, not by *behaviour*: a package+cert
+match means "this exact build is the real, signed app", which is a much
+stronger signal than any static capability heuristic can produce on its own.
+
+cert_sha256 values below were captured directly from APKMirror-distributed
+builds during testing — replace/expand with certs sourced from Play Console
+or Play Integrity API attestation in production, the same caveat that already
+applies to bank_registry.BANK_REGISTRY.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Optional
+
+
+class TrustTier(str, Enum):
+    TRUSTED = "TRUSTED"      # package + certificate both match a known-good publisher
+    NEUTRAL = "NEUTRAL"      # no registry entry — neither vouched for nor flagged
+    UNKNOWN = "UNKNOWN"      # package matches a known publisher but cert does not (possible clone)
+
+
+@dataclass(frozen=True)
+class TrustedPublisherProfile:
+    """Immutable profile for a well-known, legitimate (non-banking) app publisher."""
+    vendor: str
+    package: str
+    cert_sha256: tuple[str, ...] = field(default_factory=tuple)  # hex, lowercase; multiple = signing rotation
+
+
+TRUSTED_PUBLISHERS: list[TrustedPublisherProfile] = [
+    TrustedPublisherProfile(
+        vendor="Meta",
+        package="com.instagram.android",
+        cert_sha256=("5f3e50f435583c9ae626302a71f7340044087a7e2c60adacfc254205a993e305",),
+    ),
+    TrustedPublisherProfile(
+        vendor="Meta",
+        package="com.whatsapp",
+        cert_sha256=("3987d043d10aefaf5a8710b3671418fe57e0e19b653c9df82558feb5ffce5d44",),
+    ),
+    TrustedPublisherProfile(
+        vendor="Spotify",
+        package="com.spotify.music",
+        cert_sha256=("6505b181933344f93893d586e399b94616183f04349cb572a9e81a3335e28ffd",),
+    ),
+    TrustedPublisherProfile(
+        vendor="Google",
+        package="com.google.android.apps.docs.editors.docs",
+        cert_sha256=("3d7a1223019aa39d9ea0e3436ab7c0896bfb4fb679f4de5fe7c23f326c8f994a",),
+    ),
+]
+
+_PACKAGE_TO_PUBLISHER: dict[str, TrustedPublisherProfile] = {}
+_CERT_TO_PUBLISHER: dict[str, TrustedPublisherProfile] = {}
+
+for _profile in TRUSTED_PUBLISHERS:
+    _PACKAGE_TO_PUBLISHER[_profile.package.lower()] = _profile
+    for _cert in _profile.cert_sha256:
+        _CERT_TO_PUBLISHER[_cert.lower()] = _profile
+
+
+def get_trust_tier(package_name: str, certificate_hash: Optional[str]) -> tuple[TrustTier, Optional[str]]:
+    """
+    Resolve the trust tier for a package + certificate pair.
+
+    Returns:
+        (tier, vendor) — vendor is the matched publisher name, or None if no match.
+    """
+    profile = _PACKAGE_TO_PUBLISHER.get(package_name.lower())
+    if profile is None:
+        return TrustTier.NEUTRAL, None
+
+    if not certificate_hash:
+        # Known package, but we have no cert to verify against — can't vouch for it
+        return TrustTier.NEUTRAL, None
+
+    if certificate_hash.lower() in (c.lower() for c in profile.cert_sha256):
+        return TrustTier.TRUSTED, profile.vendor
+
+    # Package name matches a known publisher but the certificate doesn't —
+    # this is exactly the clone-attack pattern bank_registry watches for.
+    return TrustTier.UNKNOWN, profile.vendor
+
+
+# ── Installer-source signal ─────────────────────────────────────────────────
+# A package+cert allowlist only ever covers the handful of apps someone has
+# manually verified — it can't scale to "any unknown legitimate app". The
+# installer attribution (PackageManager.getInstallSourceInfo /
+# getInstallerPackageName on the Android side) is identity-agnostic: it tells
+# you the app went through a store's review process without needing to know
+# which app it is in advance. It's deliberately a *weaker* discount than a
+# verified cert match below — store review isn't airtight (malware has
+# reached the Play Store before), so this should never outrank a confirmed
+# bank-impersonation/brand-keyword/cert-mismatch finding. See risk/fusion.py
+# for how the two are layered.
+KNOWN_APP_STORE_INSTALLERS: frozenset[str] = frozenset({
+    "com.android.vending",                  # Google Play Store
+    "com.google.android.packageinstaller",  # Google Play, some OEM/AOSP paths
+    "com.android.packageinstaller",         # AOSP package installer
+    "com.sec.android.app.samsungapps",      # Samsung Galaxy Store
+    "com.amazon.venezia",                   # Amazon Appstore
+})
+
+
+def is_known_app_store(installer_package_name: Optional[str]) -> bool:
+    """True if `installer_package_name` is a recognized official app store.
+
+    Note: this is almost always unset for the "scan a freshly downloaded APK
+    before the user installs it" flow — Android only records install-source
+    attribution for already-installed packages, so this signal only becomes
+    available on a later re-scan or when re-checking an existing app's update.
+    """
+    return bool(installer_package_name) and installer_package_name in KNOWN_APP_STORE_INSTALLERS

app/services/risk/fusion.py

@@ -31,10 +31,17 @@ from app.services.apk_intelligence.models import (
     EngineResults,
     ImpersonationResult,
     MLResult,
+    ReputationInfo,
     ThreatIntelligenceResponse,
     Verdict,
     YaraResult,
 )
+from app.services.identity.bank_registry import find_brand_keyword, is_official_package
+from app.services.identity.trusted_publisher_registry import (
+    TrustTier,
+    get_trust_tier,
+    is_known_app_store,
+)
 from app.services.risk.escalation import EscalationResult, detect_escalation
 
 logger = logging.getLogger(__name__)
@@ -45,6 +52,23 @@ _WEIGHT_YARA = 0.25
 _WEIGHT_ANDROGUARD = 0.15
 _WEIGHT_IMPERSONATION = 0.10
 
+# ── Identity-layer constants ─────────────────────────────────────────────────
+# A verified package+cert match against a known-good publisher is a much
+# stronger signal than any static capability heuristic — capabilities like
+# SMS access, camera+location+contacts, or a self-update permission are
+# *expected* in a signed build of a real app and shouldn't be scored the same
+# way they would be for an unsigned/unknown APK exhibiting the same behaviour.
+_TRUSTED_PUBLISHER_DISCOUNT = 0.25       # multiply fused_score by this when TRUSTED
+# Weaker than the cert-match discount above: passing app-store review is real
+# but not airtight identity verification (malware has reached the Play Store
+# before), so this must never be allowed to outrank a confirmed
+# impersonation/brand-keyword/cert-mismatch finding — see ordering in
+# fuse_results, where hard floors are applied via max() *after* this discount.
+_KNOWN_STORE_INSTALL_DISCOUNT = 0.6
+_PUBLISHER_CERT_MISMATCH_FLOOR = 0.55    # known publisher package, wrong cert → likely clone
+_BRAND_KEYWORD_WITHOUT_MATCH_FLOOR = 0.75  # banking brand name, not an official bank app
+_UNCORROBORATED_ML_CAP = 0.35            # see "1. ML contribution" below
+
 # ── Confidence model constants ───────────────────────────────────────────────
 _CONFIDENCE_BASE = 0.5
 _CONFIDENCE_PER_CATEGORY = 0.08
@@ -62,14 +86,23 @@ def fuse_results(
     engine_results: EngineResults,
     local_risk: float,
     package_name: str,
+    certificate_hash: Optional[str] = None,
+    app_name: Optional[str] = None,
+    installer_package_name: Optional[str] = None,
 ) -> ThreatIntelligenceResponse:
     """
     Fuse all engine results into a final ThreatIntelligenceResponse.
 
     Args:
-        engine_results: Aggregated outputs from all analysis engines.
-        local_risk:     Local SDK risk score (0–100).
-        package_name:   APK package name (for logging).
+        engine_results:          Aggregated outputs from all analysis engines.
+        local_risk:               Local SDK risk score (0–100).
+        package_name:             APK package name (for logging and identity checks).
+        certificate_hash:         SHA-256 of the signing certificate, used to resolve
+                                   publisher/bank identity trust (see identity/ registries).
+        app_name:                 Human-readable app label, used for brand-keyword checks.
+        installer_package_name:  Package name of the app that installed this APK (e.g.
+                                   com.android.vending for Play Store). Usually None for
+                                   not-yet-installed files — see trusted_publisher_registry.
 
     Returns:
         ThreatIntelligenceResponse matching the Android SDK wire format.
@@ -78,8 +111,23 @@ def fuse_results(
     fused_score = 0.0
 
     # ── 1. ML contribution ────────────────────────────────────────────────────
+    # Interim mitigation for a known model-calibration issue: apk_classifier.pkl
+    # was trained on a heavily imbalanced dataset (10,110 malware vs. 1,795 benign
+    # samples) and outputs 90%+ malware probability even on near-empty feature
+    # vectors for ordinary unsigned apps with no real risk signal — confirmed on
+    # two known-benign hackathon-project APKs with no SMS/overlay/accessibility
+    # permissions and no YARA matches. Until the model is retrained on a better-
+    # balanced dataset, an uncorroborated ML score (no other engine agrees
+    # there's anything to see) gets capped rather than trusted at full weight.
     ml = engine_results.ml
     ml_score = _score_ml(ml, explanations)
+    if not _has_corroborating_signal(engine_results) and ml_score > _UNCORROBORATED_ML_CAP:
+        explanations.append(
+            f"ML model probability ({ml_score:.0%}) is not corroborated by any other "
+            f"engine — capping its contribution in the fused score (known model "
+            f"calibration issue, see fusion.py)."
+        )
+        ml_score = _UNCORROBORATED_ML_CAP
     fused_score += ml_score * _WEIGHT_ML
 
     # ── 2. YARA contribution ──────────────────────────────────────────────────
@@ -108,12 +156,43 @@ def fuse_results(
         explanations.append(f"Android SDK local risk score is high ({local_risk:.0f}/100).")
     fused_score = min(fused_score + local_boost, 1.0)
 
-    # ── 7. Hard overrides ─────────────────────────────────────────────────────
-    # YARA match → always at least SUSPICIOUS
-    if yara.rule_names:
+    # ── 7. Identity layer — certificate/publisher/installer trust ─────────────
+    # Resolved before the hard overrides below. A verified package+cert match
+    # means this exact build is the real, signed app; a known-app-store
+    # installer is weaker (review isn't airtight) but identity-agnostic — it
+    # scales to any app, not just ones manually added to the publisher registry.
+    trust_tier, trusted_vendor = get_trust_tier(package_name, certificate_hash)
+    store_installed = trust_tier != TrustTier.TRUSTED and is_known_app_store(installer_package_name)
+
+    # Apply identity-based discounts to the capability-weighted score itself —
+    # deliberately *before* the hard floors below, so neither discount can ever
+    # dilute a confirmed clone/impersonation/brand-keyword finding (those are
+    # applied via max() afterward and always win, regardless of any discount
+    # applied here).
+    if trust_tier == TrustTier.TRUSTED:
+        pre_discount_score = fused_score
+        fused_score = round(fused_score * _TRUSTED_PUBLISHER_DISCOUNT, 4)
+        explanations.append(
+            f"Certificate matches verified publisher '{trusted_vendor}' — "
+            f"applying trust discount (raw score {pre_discount_score:.3f} → {fused_score:.3f})."
+        )
+    elif store_installed:
+        pre_discount_score = fused_score
+        fused_score = round(fused_score * _KNOWN_STORE_INSTALL_DISCOUNT, 4)
+        explanations.append(
+            f"Installed via a recognized app store (installer={installer_package_name}) — "
+            f"applying a moderate trust discount (raw score {pre_discount_score:.3f} → {fused_score:.3f})."
+        )
+
+    # ── 8. Hard overrides (always win — applied via max() after any discount) ─
+    # YARA match → at least SUSPICIOUS, *unless* the publisher is verified trusted
+    # or the app came through a known store (a signed Instagram/Spotify build, or
+    # any Play-Store-installed app, matching a capability-only YARA rule is
+    # expected; an unknown, unattributed APK doing the same is not).
+    if yara.rule_names and trust_tier != TrustTier.TRUSTED and not store_installed:
         fused_score = max(fused_score, 0.45)
 
-    # Confirmed impersonation → always MALICIOUS
+    # Confirmed banking-app impersonation → always MALICIOUS
     if imp.is_impersonating and imp.similarity_score >= 0.90:
         fused_score = max(fused_score, 0.80)
         explanations.append(
@@ -121,7 +200,29 @@ def fuse_results(
             f"(target: {imp.impersonated_bank}, score: {imp.similarity_score:.0%})."
         )
 
-    # ── 8. Verdict determination ──────────────────────────────────────────────
+    # Package name matches a known publisher (banking or otherwise) but the
+    # certificate doesn't — classic clone/repackage pattern, independent of
+    # whether the impersonation engine's name/package-similarity checks fired.
+    if trust_tier == TrustTier.UNKNOWN:
+        fused_score = max(fused_score, _PUBLISHER_CERT_MISMATCH_FLOOR)
+        explanations.append(
+            f"Package name matches known publisher '{trusted_vendor}' but the signing "
+            f"certificate does not — possible clone or repackaged app."
+        )
+
+    # Banking-brand keyword in the package/app name without being a recognized
+    # official banking app — catches near-miss fakes that don't score high
+    # enough on name-similarity to trip the dedicated impersonation check.
+    if not imp.is_impersonating and not is_official_package(package_name):
+        keyword = find_brand_keyword(f"{package_name} {app_name or ''}")
+        if keyword:
+            fused_score = max(fused_score, _BRAND_KEYWORD_WITHOUT_MATCH_FLOOR)
+            explanations.append(
+                f"App name/package references banking brand '{keyword}' but is not a "
+                f"recognized official banking app — high risk of being a fake banking clone."
+            )
+
+    # ── 9. Verdict determination ──────────────────────────────────────────────
     from app.config import get_settings
     settings = get_settings()
 
@@ -138,34 +239,72 @@ def fuse_results(
     explanations.insert(0, f"Fused risk score: {fused_score:.3f} (verdict: {verdict.value}).")
 
     logger.info(
-        "Risk fusion for %s → fused=%.3f, verdict=%s, yara=%s, ml_prob=%.3f",
+        "Risk fusion for %s → fused=%.3f, verdict=%s, trust=%s, yara=%s, ml_prob=%.3f",
         package_name,
         fused_score,
         verdict.value,
+        trust_tier.value,
         yara.rule_names,
         ml.malware_probability,
     )
 
-    # ── 9. Escalation flag ────────────────────────────────────────────────────
+    # ── 10. Escalation flag ───────────────────────────────────────────────────
     escalation = detect_escalation(engine_results)
 
-    # ── 10. Numeric confidence score ──────────────────────────────────────────
+    # ── 11. Numeric confidence score ──────────────────────────────────────────
     confidence_score = _compute_confidence(engine_results, fused_score, verdict, escalation)
 
+    # ── 12. Reputation summary (wire field) ───────────────────────────────────
+    reputation = ReputationInfo(
+        known_samples=0,
+        certificate_trust=(
+            "TRUSTED" if trust_tier == TrustTier.TRUSTED
+            else "SUSPICIOUS" if trust_tier == TrustTier.UNKNOWN
+            else "NEUTRAL"
+        ),
+    )
+
+    # A CLEAN verdict shouldn't carry a threat family label — once the trust
+    # discount (or any other override) has cleared the app, naming a "family"
+    # from suppressed static findings would contradict the verdict shown.
+    threat_family = (
+        None if verdict == Verdict.CLEAN
+        else ml.threat_family or _infer_threat_family(engine_results)
+    )
+
     return ThreatIntelligenceResponse(
         verdict=verdict,
         malware_probability=round(fused_score, 4),
         yara_matches=yara.rule_names,
-        threat_family=ml.threat_family or _infer_threat_family(engine_results),
+        threat_family=threat_family,
         explanations=explanations,
         confidence_score=confidence_score,
         escalation=escalation.escalate,
         escalation_reasons=escalation.reasons,
+        reputation=reputation,
     )
 
 
 # ── Per-engine scorers ────────────────────────────────────────────────────────
 
+def _has_corroborating_signal(r: EngineResults) -> bool:
+    """True if at least one *reliable* engine independently flags risk —
+    manifest-confirmed security features, an actual YARA rule match, confirmed
+    impersonation, a real evasion suite, or a high-confidence capability finding.
+    Used to gate the ML cap above: these are all signals derived from real
+    parsed manifest data or multi-signature corroboration, not single bare
+    string hits, so they're trustworthy enough to vouch for an ML score."""
+    sf = r.androguard.security_features
+    return bool(
+        r.yara.rule_names
+        or r.impersonation.is_impersonating
+        or (sf and (sf.sms_access or sf.overlay or sf.accessibility_service))
+        or r.apkid.packers
+        or len(r.apkid.anti_analysis) > 1
+        or any(c.confidence == "HIGH" for c in r.reverse_engineering.capabilities)
+    )
+
+
 def _score_ml(ml: MLResult, explanations: list[str]) -> float:
     if ml.error:
         explanations.append(f"ML engine error: {ml.error}")
@@ -195,10 +334,17 @@ def _score_androguard(a: AndroguardResult, explanations: list[str]) -> float:
         return 0.0
     score = 0.0
     if a.is_obfuscated:
-        score += 0.30
+        # R8/ProGuard minification is the default for virtually all production
+        # release builds — name mangling alone isn't a meaningful malice signal.
+        score += 0.10
         explanations.append("APK appears to be obfuscated.")
     if a.dynamic_code_loading:
-        score += 0.25
+        # DexClassLoader usage on its own is a feature-delivery/plugin pattern used
+        # by many large legitimate apps (Play Feature Delivery, A/B experiments) —
+        # not inherently malicious. It's a mild signal here; the stronger escalation
+        # path is YARA's TROJAN_DROPPER rule, which requires it paired with an
+        # actual silent-install permission before treating it as a dropper chain.
+        score += 0.10
         explanations.append("Dynamic code loading detected (DexClassLoader pattern).")
     for act in a.suspicious_activities:
         score += 0.15
@@ -226,10 +372,17 @@ def _score_apkid(apkid: APKidResult, explanations: list[str]) -> float:
         names = ", ".join(apkid.packers)
         explanations.append(f"APKiD: packer(s) detected — {names}.")
         boost += 0.08
-    if apkid.anti_analysis:
+    if len(apkid.anti_analysis) > 1:
+        # Multiple distinct evasion categories together (anti-emulator + anti-debug +
+        # anti-frida etc.) is the real evasion-suite signal. A single category alone
+        # (e.g. one debugger-state check used for crash-reporting telemetry) is common
+        # in legitimate hardened release builds and gets a much smaller bump below.
         techniques = ", ".join(apkid.anti_analysis[:4])
-        explanations.append(f"APKiD: anti-analysis techniques — {techniques}.")
+        explanations.append(f"APKiD: anti-analysis evasion suite detected — {techniques}.")
         boost += 0.05
+    elif apkid.anti_analysis:
+        explanations.append(f"APKiD: anti-analysis technique detected — {apkid.anti_analysis[0]}.")
+        boost += 0.01
     if len(apkid.obfuscators) > 1:
         explanations.append(f"APKiD: multiple obfuscators detected ({len(apkid.obfuscators)}).")
         boost += 0.02

rules/android_banker.yar

@@ -18,16 +18,20 @@ rule BANKING_TROJAN
 
     strings:
         // ── Known banking trojan family identifiers ──────────────────────────
-        // These strings appear in DEX string pools or embedded asset paths
-        $fam_bankbot    = "bankbot"    ascii nocase
-        $fam_cerberus   = "cerberus"   ascii nocase
-        $fam_flubot     = "flubot"     ascii nocase
-        $fam_sharkbot   = "sharkbot"   ascii nocase
-        $fam_eventbot   = "eventbot"   ascii nocase
-        $fam_anubis     = "anubis_c2"  ascii nocase
-        $fam_godfather  = "godfather"  ascii nocase
-        $fam_octo       = "octo.panel" ascii nocase
-        $fam_joker      = "joker.payload" ascii nocase
+        // These strings appear in DEX string pools or embedded asset paths.
+        // Bounded with a non-letter lookalike on both sides — plain substring
+        // matching false-positived on unrelated identifiers that merely contain
+        // the token mid-word, e.g. "eventbot" inside Instagram/Spotify's
+        // "...DirectEventBottomSheetFragment..." UI class names.
+        $fam_bankbot    = /[^a-zA-Z]bankbot[^a-zA-Z]/    ascii nocase
+        $fam_cerberus   = /[^a-zA-Z]cerberus[^a-zA-Z]/   ascii nocase
+        $fam_flubot     = /[^a-zA-Z]flubot[^a-zA-Z]/     ascii nocase
+        $fam_sharkbot   = /[^a-zA-Z]sharkbot[^a-zA-Z]/   ascii nocase
+        $fam_eventbot   = /[^a-zA-Z]eventbot[^a-zA-Z]/   ascii nocase
+        $fam_anubis     = /[^a-zA-Z]anubis_c2[^a-zA-Z]/  ascii nocase
+        $fam_godfather  = /[^a-zA-Z]godfather[^a-zA-Z]/  ascii nocase
+        $fam_octo       = /[^a-zA-Z]octo\.panel[^a-zA-Z]/    ascii nocase
+        $fam_joker      = /[^a-zA-Z]joker\.payload[^a-zA-Z]/ ascii nocase
 
         // ── Credential harvesting field names in layout XML or DEX ───────────
         $cred_card      = "cardNumber"     ascii
@@ -38,9 +42,7 @@ rule BANKING_TROJAN
         $cred_pass_edit = "editPassword"   ascii
         $cred_pass_hint = "passwordHint"   ascii
 
-        // ── Overlay / screen-draw permission ────────────────────────────────
-        // wide catches UTF-16 in binary AXML manifest; ascii catches DEX string pool
-        $overlay_perm   = "SYSTEM_ALERT_WINDOW"     ascii wide
+        // ── Overlay / screen-draw behavior ────────────────────────────────
         $overlay_type   = "TYPE_APPLICATION_OVERLAY" ascii
         $overlay_draw   = "drawOverApps"             ascii
 
@@ -53,11 +55,17 @@ rule BANKING_TROJAN
         // Definitive family string hit
         1 of ($fam_*)
         or
-        // Credential field cluster — genuine banking trojans harvest many fields
-        3 of ($cred_*)
+        // Credential field cluster — genuine banking trojans harvest many fields in one
+        // fake-login form. 3 distinct field names was satisfiable by an app that simply
+        // has a checkout form (cardNumber, expiryDate) *and*, completely unrelated, a
+        // separate login form (etPassword) elsewhere — not necessarily one coordinated
+        // overlay. Require 4 to make incidental cross-feature overlap far less likely.
+        4 of ($cred_*)
         or
-        // Overlay permission paired with any credential field
-        (1 of ($overlay_*) and 1 of ($cred_*))
+        // Actual overlay-window creation (not just the bare SYSTEM_ALERT_WINDOW
+        // permission, which any chat-head/floating-widget/PiP app legitimately
+        // declares) paired with a credential field
+        (1 of ($overlay_type, $overlay_draw) and 1 of ($cred_*))
         or
         // Explicit fake-login string
         1 of ($fake_login*)

rules/otp_stealer.yar

@@ -17,11 +17,17 @@ rule OTP_STEALER
         date        = "2024-01-01"
 
     strings:
-        // Permission strings — stored as UTF-16 LE in binary AXML manifest,
-        // so match both ascii (DEX string pool) and wide (AXML binary format)
-        $p_read    = "READ_SMS"    ascii wide
-        $p_receive = "RECEIVE_SMS" ascii wide
-        $p_send    = "SEND_SMS"    ascii wide
+        // Manifest-DECLARED permissions only — <uses-permission> entries are stored
+        // as UTF-16 LE in the binary AXML manifest, so wide-only reliably means "the
+        // app's manifest actually requests this." Deliberately *not* ascii: an ascii
+        // hit for "READ_SMS" is just as likely a bundled cross-platform permission
+        // library (e.g. Flutter's permission_handler ships every Android permission
+        // name as a constant) referencing the string without the app ever declaring
+        // or using it — confirmed false-positive on a real hackathon Flutter app
+        // with zero SMS permissions in its actual manifest.
+        $p_read    = "READ_SMS"    wide
+        $p_receive = "RECEIVE_SMS" wide
+        $p_send    = "SEND_SMS"    wide
 
         // Android SMS API class and content-provider URI (DEX string pool, ASCII)
         $api_class  = "SmsMessage"             ascii
@@ -39,15 +45,20 @@ rule OTP_STEALER
         $kw_otp4  = "verificationCode" ascii
 
     condition:
-        // Two or more SMS permission strings (wide catches binary AXML)
+        // Two or more manifest-declared SMS permissions
         (2 of ($p_*))
         or
-        // SMS API usage combined with any permission string
+        // SMS API usage combined with an actual manifest-declared permission
         (1 of ($api_*) and 1 of ($p_*))
         or
-        // Direct OTP keyword combined with SMS permission
-        (1 of ($kw_*) and 1 of ($p_*))
+        // OTP keyword combined with actual SMS API usage, not just a declared
+        // permission — a bare "otp" substring plus a single SMS permission is
+        // satisfied by any ordinary app implementing standard OTP/2FA login.
+        (1 of ($kw_*) and 1 of ($api_*, $smali_sms))
         or
-        // Pure DEX: two SMS API strings — sufficient without permission match
+        // Pure DEX: two SMS API strings — sufficient without permission match.
+        // This is the fallback for cases where the manifest's permission
+        // declaration is itself obfuscated/stripped but the SMS-reading code
+        // is genuinely present.
         (2 of ($api_*, $smali_sms))
 }

rules/rat.yar

@@ -24,7 +24,6 @@ rule REMOTE_ACCESS_TROJAN
         $acc_service    = "AccessibilityService"        ascii
         $acc_event      = "onAccessibilityEvent"        ascii
         $acc_action     = "performGlobalAction"         ascii
-        $acc_node       = "AccessibilityNodeInfo"       ascii
 
         // ── Screen capture / remote viewing ─────────────────────────────────
         $screen_proj    = "MediaProjection"             ascii
@@ -32,9 +31,6 @@ rule REMOTE_ACCESS_TROJAN
         $screen_cap     = "screencap"                   ascii nocase
 
         // ── Remote shell / command execution ────────────────────────────────
-        // Use exact Smali descriptor to avoid matching RuntimeException
-        $cmd_runtime    = "Ljava/lang/Runtime;"         ascii
-        $cmd_exec       = "getRuntime"                  ascii
         $cmd_shell      = "/system/bin/sh"              ascii
         $cmd_builder    = "ProcessBuilder"              ascii
 
@@ -47,12 +43,21 @@ rule REMOTE_ACCESS_TROJAN
         // BIND_ACCESSIBILITY_SERVICE permission (wide = binary AXML, ascii = DEX string pool)
         $acc_perm
         or
-        // Accessibility callback method + service class — rules out compat-lib stub matches
-        ($acc_event and 1 of ($acc_service, $acc_action, $acc_node))
+        // Accessibility callback method + service class — rules out compat-lib stub matches.
+        // $acc_node is deliberately excluded here: AccessibilityNodeInfo is referenced by
+        // the AndroidX/support-lib accessibility compliance code bundled in almost every app.
+        ($acc_event and 1 of ($acc_service, $acc_action))
         or
-        // Screen capture combined with accessibility or shell access
-        (1 of ($screen_*) and (1 of ($acc_*) or 1 of ($cmd_*)))
+        // Screen capture combined with actual accessibility *automation* (event callback or
+        // synthesized global action) — not just service/node presence, which legitimate
+        // screen-cast/Cast-receiver code pulls in alongside MediaProjection/createVirtualDisplay.
+        (1 of ($screen_*) and 1 of ($acc_event, $acc_action))
         or
-        // Remote shell with C2 indicator
-        (2 of ($cmd_*) and 1 of ($c2_*))
+        // Remote shell execution — explicit shell binary path, not just generic
+        // Runtime/getRuntime/ProcessBuilder references used by many legitimate
+        // native-lib loaders and crash reporters — paired with a C2 indicator
+        ($cmd_shell and 1 of ($c2_*))
+        or
+        // Shell path built and executed via ProcessBuilder
+        ($cmd_shell and $cmd_builder)
 }

rules/spyware_collector.yar

@@ -29,21 +29,34 @@ rule SPYWARE_COLLECTOR
         $call_log    = "READ_CALL_LOG"          ascii wide
         $outgoing    = "PROCESS_OUTGOING_CALLS"  ascii wide
         $calllog_api = "Landroid/provider/CallLog" ascii
+        $contacts_api = "Landroid/provider/ContactsContract;" ascii
 
         // ── Audio / camera recording ─────────────────────────────────────────────
-        $audio = "RECORD_AUDIO"             ascii wide
-        $cam   = "android.permission.CAMERA" ascii wide
+        $audio     = "RECORD_AUDIO"             ascii wide
+        $cam       = "android.permission.CAMERA" ascii wide
+        $audio_api = "MediaRecorder"             ascii
+        $cam_api   = "CameraManager"             ascii
 
         // ── Persistence ───────────────────────────────────────────────────────────
         $boot = "RECEIVE_BOOT_COMPLETED" ascii wide
 
     condition:
-        // Location + (contacts / call log / call interception) + (audio or camera)
-        (1 of ($loc_fine, $loc_coarse) and 1 of ($contacts, $call_log, $outgoing) and 1 of ($audio, $cam))
+        // Location + contacts/call-log + audio/camera *API usage*, not just the bare
+        // permission declarations — large legitimate apps (Docs: Drive/voice-typing/
+        // camera-scan; Instagram: geotagging/stories) hold all of these permissions for
+        // unrelated single-purpose features without ever invoking the other domains'
+        // APIs in combination. Actual class-level usage across all three domains
+        // together is a much stronger spyware signal.
+        ($loc_api and 1 of ($calllog_api, $contacts_api) and 1 of ($audio_api, $cam_api)
+            and 1 of ($loc_fine, $loc_coarse) and 1 of ($contacts, $call_log, $outgoing) and 1 of ($audio, $cam))
         or
-        // Contact/call-log harvesting + microphone recording + boot persistence
-        (1 of ($contacts, $call_log, $outgoing) and $audio and $boot)
+        // Contact/call-log API usage + microphone recording API + boot persistence
+        (1 of ($calllog_api, $contacts_api) and $audio_api and $boot
+            and 1 of ($contacts, $call_log, $outgoing) and $audio)
         or
-        // Location-manager API paired with call-log provider access in DEX
-        ($loc_api and $calllog_api)
+        // Location-manager API paired with call-log provider access in DEX,
+        // corroborated by the matching dangerous permissions — the bare class-name
+        // strings alone are present in any app bundling Play Services/GMS, even
+        // when the location/call-log capability is never invoked.
+        ($loc_api and $calllog_api and 1 of ($loc_fine, $loc_coarse) and 1 of ($contacts, $call_log))
 }

rules/trojan_dropper.yar

@@ -34,16 +34,23 @@ rule TROJAN_DROPPER
         $write_secure = "WRITE_SECURE_SETTINGS"   ascii wide
 
         // ── Dynamic code loading — fetches/executes secondary payloads ─────────
-        $dex_loader    = "DexClassLoader"                     ascii
-        $pkg_installer = "Landroid/content/pm/PackageInstaller;" ascii
+        $dex_loader    = "DexClassLoader" ascii
 
     condition:
-        // Boot persistence + any silent-install or device-takeover permission
-        ($boot and 1 of ($req_install, $install_pkgs, $del_pkgs, $device_admin, $force_lock, $write_secure))
+        // Boot persistence + device-admin/lockscreen takeover — rarely legitimate
+        // together, unlike a bare silent-install permission (see below)
+        ($boot and 1 of ($device_admin, $force_lock, $write_secure))
         or
-        // Two or more silent package-management / takeover permissions on their own
+        // Two or more silent package-management / takeover permissions together —
+        // a single one (e.g. REQUEST_INSTALL_PACKAGES for a self-update flow) is
+        // common in legitimate apps and isn't enough on its own
         (2 of ($req_install, $install_pkgs, $del_pkgs, $device_admin, $force_lock, $write_secure))
         or
-        // Silent-install permission paired with dynamic code loading
-        (1 of ($req_install, $install_pkgs, $del_pkgs) and 1 of ($dex_loader, $pkg_installer))
+        // Silent-install permission paired with actual dynamic code loading — the
+        // dangerous combo a ghostpush-style dropper needs to fetch and run a payload.
+        // PackageInstaller class references alone were dropped from this branch: that's
+        // the standard Android self-update/in-app-update API surface, present in any
+        // legitimate app with an update flow (e.g. Spotify, which has REQUEST_INSTALL_PACKAGES
+        // + a PackageInstaller reference but no dynamic code loading at all).
+        (1 of ($req_install, $install_pkgs, $del_pkgs) and $dex_loader)
 }