Beyond the APK: A Traceable Cyber-Forensic Workflow for Layered Android Threats

Beyond the APK: A Traceable Cyber-Forensic Workflow for Layered Android Threats Abstract: Cyber-forensic examination of layered Android threats requires more than a list of permissions or a readable decompilation: investigators must connect concealed execution paths to recoverable artifacts and bounded behavioral claims. This paper presents a traceable workflow that organizes established methods into five stages: artifact identification, execution-path reconstruction, concealed-payload recovery, runtime correlation, and claim-to-evidence reporting. Four evidence classes distinguish incident reports, static capability, laboratory observations, and analytical assessment. A worked investigation of a customer-support-themed APK demonstrates the workflow using retained analysis records. Bytecode inspection, native-code analysis, and deterministic asset decryption recover an encrypted installer and remote-control payload. Archived captures from a separately installed, re-signed payload show HTTP bootstrap, runtime controller-address replacement, and WebSocket messaging. Tool failures and differences between the Android 11 laboratory and the reported Android 15 incident remain explicit. The contribution is a practical synthesis of forensic methods and a reporting structure that makes unsupported inferences visible, not a new detection algorithm or a statistically validated framework. The application demonstrates technical traceability in one investigation; it does not establish operator identity, financial causation, or general effectiveness across malware families. Package contents: android_remote_control_case_study.pdf — Full publication preprint manuscript. EVIDENCE_INDEX.md — Public non-executable evidence index and claim-to-source register. paper-publication-package.zip — Complete LaTeX sources, BibTeX references, and vector diagram sources.