poppy_seed

Poppy Seed is an malware analysis tool

View the Project on GitHub sdswapz/poppy_seed

Poppy Seed - Android Static Analyzer

alt text

What is Poppy Seed?

Poppy Seed is an abstraction of malware analysis tool designed for Android OS platform. It provides static analysis capabilities to detect and analyze Android malware, with a focus on discovering security controls enforced by obfuscators, packers, and protectors.

Why Poppy Seed?

According to Wikipedia, poppy seeds provide ‘supposed magical powers of invisibility’ - and who doesn’t love invisibility, right? Including malware authors! But this Poppy Seed app will help you unveil the magic cloak around malware apps.

Features

Quick Start

Prerequisites

Installation & Setup

  1. Install Docker:
  2. Clone and run: 
    git clone https://github.com/sdswapz/poppy_seed.git
cd poppy_seed
docker-compose up --build
  3. Access the application:
    • Main Interface: http://localhost:8000/
    • All features available immediately

Option 2: Quick Setup Script

  1. Clone the repository: 
    git clone https://github.com/sdswapz/poppy_seed.git
cd poppy_seed
  2. Run the setup script: 
    ./setup.sh

The setup script will automatically:

Manual Setup

  1. Clone the repository: 
    git clone https://github.com/sdswapz/poppy_seed.git
cd poppy_seed/Django
  2. Install dependencies: 
    pip3 install -r ../requirements.txt
# OR
pip3 install django
  3. Run migrations: 
    python3 manage.py migrate
  4. Start the development server: 
    python3 manage.py runserver

Access the Application

Once the server is running, access the application at:

Usage

  1. Upload Files: Use the drag-and-drop interface to upload Android APK files
  2. Analysis: The system will automatically analyze the files for:
    • File type detection using magic bytes
    • Packer/protection scheme identification
    • Android manifest parsing
    • Resource file analysis
  3. Results: View analysis results and browse the malware repository

Technical Details

Development Status

Current Status (2024)

Development Phases

  1. Phase 1: Security Controls Discovery ✅ COMPLETED
    • Timeline: December 8, 2017 (Released before BSides Philly)
    • Features: Packer detection, file type identification, basic analysis
  2. Phase 2: Static Malware Analysis 🔄 IN PROGRESS
    • Timeline: January 30, 2018 (Planned)
    • Features: Advanced static analysis, malware detection patterns
  3. Phase 3: Dynamic Analysis 📋 PLANNED
    • Timeline: April 8, 2018 (Planned)
    • Features: Dynamic analysis, behavior detection, runtime monitoring

Contributing

Contributors are always welcome! We need expertise in:

  1. Python Development: Core application logic and parsers
  2. Malware Analysis: Security research and detection patterns
  3. Django Frontend: Web interface and user experience
  4. Docker: Containerization and deployment
  5. Security Research: Android malware analysis and reverse engineering

Recent Updates

Documentation

License

This project is licensed under the MIT License - see LICENSE.md for details.

The MIT License provides maximum freedom for users to:

We believe in contributing back to the community by removing barriers to entry. However, all dependencies must comply with their respective licensing agreements.

Troubleshooting

Common Issues

  1. “can’t open file ‘manage.py’“: 
    # Make sure you're in the Django directory
cd poppy_seed/Django
python3 manage.py runserver
  2. Django Import Errors: 
    # Install Django if not already installed
pip3 install django
  3. Database Migration Issues: 
    # Run migrations from the Django directory
cd poppy_seed/Django
python3 manage.py migrate
  4. Port Already in Use: 
    # Use a different port
python3 manage.py runserver 8080

System Requirements

About the Authors

Contributors

Swapnil Deshmukh

alt text

Swapnil Deshmukh has over 10 years of information technology and information security experience, including technical expertise, leadership, strategy, operational and risk management. Charged with incubating and evangelizing security-driven, context-driven risk management strategies, policies and practices for emerging technologies.

Notable Achievements:

Sarath Geethakumar

Sarath Geethakumar is a security researcher and practitioner with over 15 years of information security experience. He has co-authored “Hacking Exposed Mobile: Security Secrets & Solutions” and specializes in mobile security research and malware analysis.

Disclaimer

The views, code, and opinions in this project are those of the authors as independent researchers and do not necessarily reflect the official policy or position of any company. Research on malware analysis is performed based on personal experience and professional connections. This work is not reflective of the position of any individual or company other than the authors.

Support