Android Malware Behavior Deleter

UDcide is a tool that provides alternative way to deal with Android malware. We help you to detect and remove specific behaviors in the malware rather than just delete the whole binary. And surprisingly, we make the binary runs still. This enables possibilities of malware investigation (e.g. Delete behaviors like VM detection, icon hiding etc. Helping analysts overcome malware evasion problems during the analysis).

We also provide a VScode extension to use UDcide, download from Marketplace and see the usage below.

• (Ctrl + Shift + P) to open command palette -> UDcide: Android Malware Behavior Deleter -> Choose an APK file

• Select behaviors to disable -> Click Rebuild

This is a showcase which the malware hides its icon after user clicks on it.

As you can see, the icon of the malware disappear right after the user clicks.

With UDcide, we remove this behavior, got this malware no where to hide.

This is the same showcase but using VScode extension to disable the behavior.

Disable the behavior by using UDcide VScode extension.

• dialog >= 1.3-20190808
• JDK >= 11
• Apktool >= 2.5.0

git clone https://github.com/UDcide/udcide.git
cd udcide
pipenv install
pipenv run python udcide/cli.py <APK_File>