What it does
ASL X-Ray is an APK analyzer for Android apps. You give it an app file. It reads the file without installing, launching or emulating it. The hosted service first checks the original file against a known-malware signature set. It then recovers the app three ways: readable source, the decoded manifest and resource structure, and a raw inventory of package entries. The report gives a risk score out of 100, a plain-language verdict, and what the app appears able to do. It explains why each behaviour was flagged. It shows where in the file the evidence sits. It states how much of the app could be read. It also says that static analysis cannot prove an app is safe. The web and API surfaces and the Windows suite are early access, and the Windows suite is provided on request rather than from a public download page. ASL X-Ray Lite on Google Play is the publicly available app.
Capabilities
- The analysis catalog has 48 behaviour rules. Ten of them are attack-chain rules that combine other findings into named patterns such as credential theft, dropper, ransomware and remote control.
- ASL X-Ray Lite is an Android phone app that scans on the device and applies 17 of the rules locally. It needs no account and declares no platform permissions.
- Every finished hosted scan produces a machine-readable report, a written report and a self-contained page. Reports carry file hashes and evidence locations.
- The hosted service deletes the uploaded app and everything recovered from it when the job ends. Reports expire after 24 hours by default.
- A separate Windows suite, ASL Android Security Lab, runs entirely offline with no account, no upload and no telemetry. It has 12 modules covering 24 operations.
When to use it
- You need to decide whether an app is safe to put on work phones.
- A vendor, a contractor or an employee has handed you a sideloaded app to review.
- You are vetting a third-party build before it ships inside your own product.
