Mobile Malware · Inside a Malicious App · Lesson 4 of 5

Indicators of Compromise

Turn findings into indicators others can check, and learn which ones to trust.

Clues others can check

Analysis is only half the job. The other half is turning what you found into something other people can use to check their own phones. Those reusable clues are called indicators of compromise (IoCs): concrete, checkable facts that suggest a device has met a particular threat.

For mobile malware, the common ones are:

• Package name, the app's ID, like com.pdfscan.pro.free.
• File hash, usually SHA-256. You met hashing in Hashing & Verification: a fingerprint of the exact file, which changes completely if a single byte changes.
• Signer fingerprint, a hash of the certificate that signed the app. Since only the holder of the private key can sign with it, this ties apps back to whoever built them.
• Domains and IP addresses the malware contacts, such as its C2 server or the place it downloads its second stage.

Indicators appear in threat reports, write-ups that security companies, researchers and agencies publish about a malware family or campaign. A company security team takes those indicators and compares them against what it can see: the apps installed on managed phones, and the domain lookups recorded on its network.

A match isn't automatically a verdict, though. Some indicators can be copied or shared by perfectly innocent things. A package name is just a label the developer picks. Anyone can reuse a common-sounding one in a different app. A hash or a signer fingerprint is much harder to match by accident.

On the simulated phone, open the IoC matcher. Check each indicator from the threat report against the company phone inventory and the DNS log, and decide which ones are real hits.

Strong, weak and shared

Not all indicators are equally useful. Analysts think about two separate qualities.

How precise is it? A SHA-256 hash or a signer fingerprint almost never matches by coincidence, so a hit is very likely real. A package name or an app's display name can be reused by anyone. An IP address may belong to a hosting company that serves thousands of unrelated websites. Matching on a weak indicator alone produces false positives, alerts about things that are actually harmless, and those waste time and erode trust in the alerts.

How long will it last? Precision isn't everything. In 2013, security researcher David Bianco described a Pyramid of Pain: hashes sit at the bottom because attackers can change them trivially by rebuilding the file, IP addresses are easy to swap, and domains take a bit more effort. A hash catches one exact file. Behavior, like "asks for accessibility, then downloads an APK, then beacons every minute," is much harder for attackers to change. So good reports include both precise indicators and descriptions of behavior.

That's where MITRE ATT&CK for Mobile comes in. It's a free, public catalog of attacker tactics (goals, like Defense Evasion or Command and Control) and techniques (the ways they're achieved), each with an ID. Instead of every company inventing its own words, a report can say the sample uses T1407 (Download New Code at Runtime), T1633 (Virtualization/Sandbox Evasion) and T1637.001 (Domain Generation Algorithms). Everyone reading knows exactly what's meant.

Indicators are often shared in a machine-readable format called STIX, so tools can load them directly. For example, Amnesty International's Security Lab publishes indicators from its spyware investigations, including NSO Group cases, in a public repository, and the Mobile Verification Toolkit reads STIX files to check phones against them.

Sharing goes both ways. When your team finds something new, adding clear indicators and ATT&CK IDs to your report helps the next team.