Add Quark malware analysis report for Herodotus

docs/source/malware_report.rst

@@ -4054,3 +4054,74 @@ The table below lists the APKs we tested.
 +-------+------------------------------------------------------------------+
 | 4     | AD61E0ABE570C3575B01FBD07FC92E88C2516D1B74BB2ED536C6E2CC8E70435E |
 +-------+------------------------------------------------------------------+
+
+Herodotus Malware Family Analysis Report
+========================================
+
+This report analyses the `Herodotus <https://www.threatfabric.com/blogs/new-android-malware-herodotus-mimics-human-behaviour-to-evade-detection>`__ malware family using Quark's rule classification. Herodotus is an Android banking trojan first reported by ThreatFabric in 2025. It is built for device takeover, sold as malware-as-a-service, and distributed through side-loading, potentially involving SMS phishing (smishing) links that lead to a dropper, which then installs a separate payload. Both samples analysed here were downloaded from MalwareBazaar, where they carry the signature "Herodotus". In the two samples tested here, Quark confirms code that queries device data through ``ContentResolver``. This run did not add a new rule for Herodotus. Check `here <https://github.com/quark-engine/quark-rules>`__ for the rule set details.
+
+Quark's rule classification flagged **2 of 2 Herodotus samples** as high-risk in this experiment (detection rate **100%**). Benign-cohort false-positive rate was not measured here. Please check :ref:`here <list-of-tested-apks-herodotus>` for the APKs we tested.
+
+Identified Well-Known Threats
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This section uses MITRE ATT&CK Mobile as its reference taxonomy. MITRE ATT&CK has no software entry for Herodotus in this run's records, and the technique list did not come from ThreatFabric. It came from the MITRE entry for SpyNote RAT (S0305), which this run's threat-intelligence step associated with Herodotus because several VirusTotal verdicts for the samples name SpyNote. That association is not used anywhere else in this report, and the list should not be read as Herodotus's documented profile. Of the 6 techniques in that entry, 5 could be matched to at least one Quark rule and were evaluated. Of those **5 techniques**, Quark's static bytecode analysis confirms the **1 listed below**; see the coverage-gap notes at the end of this section for the other 4.
+
+.. list-table::
+   :header-rows: 1
+   :widths: 30 70
+
+   * - MITRE Technique
+     - Real-world manifestation
+   * - T1533 Data from Local System
+     - Querying device data through a content provider
+
+All behavior maps below were rendered from sample ``78533e66970f86f2a8f583b40a54c5c4a70afadda811ace35cd7380352765b1b.apk`` (package ``sruddRsS.RmRCrBNLwB.ymVWwbF``). Both samples matched T1533, and this run picked this one as the representative sample. The other family sample was used to compute the detection-rate figure above.
+
+Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then show the Quark behavior map extracted from the representative sample's bytecode, then walk through the call sequence and list the underlying rules.
+
+**1. T1533 Data From Local System**
+
+`T1533 Data from Local System — attack.mitre.org <https://attack.mitre.org/techniques/T1533>`__
+
+    **MITRE definition (T1533):** Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges.
+
+.. image:: https://i.ibb.co/Q7nBwvQQ/t1533-data-from-local-system.png
+
+``LsruddRsS/RmRCrBNLwB/ymVWwbF/xvhojmxrnmdcug;i`` calls two helper methods. ``LsruddRsS/RmRCrBNLwB/ymVWwbF/xvhojmxrnmdcug;E`` queries device data through ``ContentResolver`` and checks the result; this query is the T1533 evidence. The rules do not show which content provider it reads, so the data is described here only as device data. ``;i`` itself and its other helper, ``LsruddRsS/RmRCrBNLwB/ymVWwbF/xvhojmxrnmdcug;e0``, each read a resource file bundled in the app's own res/raw directory. Reading the app's own resources is not T1533, so those two rules are listed for completeness only.
+
+Behaviors detected by Quark:
+
+* Get resource file from res/raw directory (#00036)
+* Read sensitive data(SMS, CALLLOG, etc) (#00077)
+* Query a URI and check the result (#00187)
+* Query device data with ContentResolver (#00212)
+
+.. _coverage-gap-notes-herodotus:
+
+**Coverage-gap notes**
+
+The 4 MITRE techniques evaluated for Herodotus that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:
+
+**No related rule matched (3)** — T1429 Audio Capture, T1636.003 Contact List and T1624.001 Broadcast Receivers.
+
+* T1429 Audio Capture: 14 related rules were tested, and none matched in either sample. The recording APIs used by the recorded example rules do not appear in the samples.
+* T1636.003 Contact List: 2 related rules were tested, and neither matched in either sample. The samples never use the required APIs together.
+* T1624.001 Broadcast Receivers: 8 related rules were tested, and none matched in either sample. The closest, "Monitor device boot completion" (#00262), finds the two calls in one method, but no data passes between them.
+
+**The only match was too generic (1)** — T1636.004 SMS Messages. 12 related rules were tested. The only behavior Quark matched was a generic intent-action check, "Monitor the general action to be performed" (#00025), which does not show SMS messages being read.
+
+.. _list-of-tested-apks-herodotus:
+
+List of Tested APKs
+~~~~~~~~~~~~~~~~~~~
+
+The table below lists the APKs we tested.
+
++-------+------------------------------------------------------------------+
+| index | sha256                                                           |
++=======+==================================================================+
+| 1     | 78533E66970F86F2A8F583B40A54C5C4A70AFADDA811ACE35CD7380352765B1B |
++-------+------------------------------------------------------------------+
+| 2     | E084A327FDE5523B1803040FC1EA40BE84BC8434913D37D01083890C351DEC96 |
++-------+------------------------------------------------------------------+