From 0778d448dfb566216a45417318a8da29c3130a10 Mon Sep 17 00:00:00 2001 From: besendorf Date: Fri, 19 Sep 2025 07:31:17 +0200 Subject: [PATCH] make virustotal check also work with androidqf extractions (#685) --- src/mvt/android/modules/adb/packages.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/mvt/android/modules/adb/packages.py b/src/mvt/android/modules/adb/packages.py index 1d9c821..421ac88 100644 --- a/src/mvt/android/modules/adb/packages.py +++ b/src/mvt/android/modules/adb/packages.py @@ -107,8 +107,7 @@ class Packages(AndroidExtraction): result["matched_indicator"] = ioc self.detected.append(result) - @staticmethod - def check_virustotal(packages: list) -> None: + def check_virustotal(self, packages: list) -> None: hashes = [] for package in packages: for file in package.get("files", []): @@ -143,8 +142,15 @@ class Packages(AndroidExtraction): for package in packages: for file in package.get("files", []): - row = [package["package_name"], file["path"]] - + if "package_name" in package: + row = [package["package_name"], file["path"]] + elif "name" in package: + row = [package["name"], file["path"]] + else: + self.log.error( + f"Package {package} has no name or package_name. packages.json or apks.json is malformed" + ) + continue if file["sha256"] in detections: detection = detections[file["sha256"]] positives = detection.split("/")[0]