# VEDRANDO: A Novel Way to Reveal Stealthy Attack Steps on Android through Memory Forensics
## 2 Background
### Just-in-Time Memory Forensics (JIT-MF)
* FluBot Malware-All You Need to Know & to Act Now [2021] FluBot Malware-All You Need to Know & to Act Now. 2021. Available online: [[https://www.threatmark.com/flubot-banking-malware/](https://www.threatmark.com/flubot-banking-malware/)]([https://www.threatmark.com/flubot-banking-malware/](https://www.threatmark.com/flubot-banking-malware/)) (accessed on 6 March 2023). * Eventbot: A New Mobile Banking Trojan Is Born [2020] Eventbot: A New Mobile Banking Trojan Is Born. 2020. Available online: [[https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born](https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born)]([https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born](https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born)) (accessed on 24 March 2023). * [PERSON] et al. [2017] [PERSON]; [PERSON]; [PERSON]; [PERSON] Vlcak and dagger: From two permissions to complete control of the UI feedback loop. In Proceedings of the IEEE S&P, San Jose, CA, USA, 22-24 May 2017; IEEE: Piscataway, NJ, USA, 2017; pp. 1041-1057. * [PERSON] et al. [2017] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Unleashing the walking dead: Understanding cross-app remote infectious on mobile webviews. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA, 30 October-3 November 2017; pp. 829-844. * [PERSON] et al. [2022] [PERSON]; [PERSON]; [PERSON] Cross Miniapp Request Forgery: Root Causes, Attacks, and Vulnerability Detection. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Los Angeles, CA, USA, 7-11 November 2022; pp. 3079-3092. * Triada [2016] Triada: Organized Crime on Android. 2016. Available online: [[https://www.kasperskycom/blog/triada-trojan/11481/](https://www.kasperskycom/blog/triada-trojan/11481/)]([https://www.kasperskycom/blog/triada-trojan/11481/](https://www.kasperskycom/blog/triada-trojan/11481/)) (accessed on 30 March 2023). * [PERSON] et al. [2019] [PERSON]; [PERSON]; [PERSON]; [PERSON] \"Jekyll and Hyde\" is Risky: Shared-Everything Threat Mitigation in Dual-Instance Apps. In Proceedings of the MobiSys, Seoul, Republic of Korea, 17-21 June 2019; ACM: New York, NY, USA, 2019; pp. 222-235. * [PERSON] et al. [2019] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Reaper: Real-time app analysis for augmenting the Android permission system. In Proceedings of the ACM CODASPY, Dallas, TX, USA, 25-27 March 2019; pp. 37-48. * [PERSON] et al. [2022] [PERSON]; [PERSON]; [PERSON]; [PERSON] PHYJacking: Physical Input Hijacking for Zero-Permission Authorization Attacks on Android. In Proceedings of the 29 th Annual Network and Distributed System Security Symposium, NDSS 2022, San Diego, CA, USA, 24-28 April 2022; The Internet Society: Reston, VA, USA, 2022. * [PERSON] et al. [2020] [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Reducing the Forensic Footprint with Android Accessibility Attacks. In Proceedings of the STM, Guildford, UK, 17-18 September 2020; pp. 22-38. * [PERSON] and [PERSON] [2018] [PERSON]; [PERSON] Volatile memory-centric investigation of SMS-hijacked phones: A Pushbullet case study. In Proceedings of the FedCSIS, Poznan, Poland, 9-12 September 2018; IEEE: Piscataway, NJ, USA, 2018; pp. 607-616. * [PERSON] and [PERSON] [2017] [PERSON]; [PERSON], III. Memory forensics: The path forward. _Digit. Investig._**2017**, _20_, 23-33. [CrossRef]
* [PERSON] et al. [2020] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON], III. Hooktracer: Automatic Detection and Analysis of Keystroke Loggers Using Memory Forensics. _Comput. Secur._**2020**, _96_, 101872. [CrossRef]
* [PERSON] et al. [2020] [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Responding to Targeted Stealthy Attacks on Android Using Timely-Captured Memory Dumps. _IEEE Access_**2020**, _10_, 35172-35218. [CrossRef]
* [PERSON] [2023] [PERSON] What is EDR? Endpoint Detection & Response Defined.