[DETECTION] enhance ELF rule: Talsec

[enovella]

APKiD output

$ apkid ../../../net.corepass.app.xapk
[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] ../../../net.corepass.app.xapk
 |-> protector : FreeRASP
[*] ../../../net.corepass.app.xapk!net.corepass.app.apk!classes.dex
 |-> anti_debug : Debug.isDebuggerConnected() check
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.HARDWARE check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, Build.TAGS check, SIM operator check, possible VM check, possible ro.secure check
 |-> compiler : r8 without marker (suspicious)
[*] ../../../net.corepass.app.xapk!net.corepass.app.apk!classes2.dex
 |-> anti_debug : Debug.isDebuggerConnected() check
 |-> anti_vm : Build.BOARD check, Build.FINGERPRINT check, Build.HARDWARE check, Build.MANUFACTURER check, Build.MODEL check, Build.PRODUCT check, Build.TAGS check, possible VM check
 |-> compiler : r8 without marker (suspicious)
[*] ../../../net.corepass.app.xapk!config.armeabi_v7a.apk
 |-> protector : FreeRASP

Sample

$ apkinfo net.corepass.app/config.armeabi_v7a.apk
APK: net.corepass.app/config.armeabi_v7a.apk
It looks like that no app name is set for the main activity!
App name:
Package: net.corepass.app
Version name: None
Version code: 1078
Is it Signed: True
Is it Signed with v1 Signatures: True
Is it Signed with v2 Signatures: True
Is it Signed with v3 Signatures: True

Fingerprint

libapp.so: package:freerasp/src/errors/talsec_exception.dart
libapp.so: package:freerasp/src/models/ios_config.g.dart
libapp.so: package:freerasp/src/models/talsec_config.dart
libapp.so: package:freerasp/src/models/ios_config.dart
libapp.so: package:freerasp/src/models/android_config.g.dart
libapp.so: package:freerasp/src/errors/configuration_exception.dart
libapp.so: package:freerasp/src/utils/config_verifier.dart
libapp.so: package:freerasp/src/models/android_config.dart
libapp.so: package:freerasp/src/talsec.dart
libapp.so: package:freerasp/src/models/talsec_config.g.dart
libapp.so: package:freerasp/src/enums/threat.dart
libapp.so: talsec.app/freerasp/methods
libapp.so: This app cannot be used on emulators or rooted devices. Exiting app now.
libapp.so: package:freerasp/src/threat_callback.dart
libapp.so: talsec.app/freerasp/events

libapp.zip