Reverse engineering of Android/Phoenix

Android/Phoenix is a malicious Remote Access Tool. Its main goal is to extensively spy on the victim’s phone (grab all screenshots, steal the unlock gesture etc). The attacker controls the infected phone via various predefined commands sent on a websocket.

This blog post contains the reverse engineering of sample 6485ead2248298b48d4e677d3fb740b8ce8688bc7b4adb7a4d2ac3af827da46b of mid January 2024. The sample poses as a Google Calendar application.

The malware poses as a Google Calendar application and asks the user to enable Accessibility for it. …

access android attacker blog blog post controls engineering etc goal grab january january 2024 main malicious malware analysis phoenix phone remote access remote access tool reverse reverse engineering sample screenshots spy steal tool unlock victim websocket