Android Malware Behavior Deleter

UDcide

UDcide is a tool that provides alternative way to deal with Android malware. We help you to detect and remove specific behaviors in the malware rather than just delete the whole binary. And surprisingly, we make the binary runs still. This enables possibilities of malware investigation (e.g. Delete behaviors like VM detection, icon hiding etc. Helping analysts overcome malware evasion problems during the analysis).

Getting Started With VScode Extension

We also provide a VScode extension to use UDcide, download from Marketplace and see the usage below.

• (Ctrl + Shift + P) to open command palette -> UDcide: Android Malware Behavior Deleter -> Choose an APK file

• Select behaviors to disable -> Click Rebuild

Showcase

This is a showcase which the malware hides its icon after user clicks on it.

As you can see, the icon of the malware disappear right after the user clicks.

With UDcide, we remove this behavior, got this malware no where to hide.

Showcase for VScode Extension

This is the same showcase but using VScode extension to disable the behavior.

Disable the behavior by using UDcide VScode extension.

Requirements

• dialog >= 1.3-20190808
• JDK >= 11
• Apktool >= 2.5.0

Installation

git clone https://github.com/UDcide/udcide.git
cd udcide
pipenv install
pipenv run python udcide/cli.py <APK_File>