Forum Thread: How Can Bypass the AV and Make Payload for Android Clean

i Embed a Metasploit Payload in an Original .Apk File but the AV Catch it

How to Encrypt it

Basically AV works by reading the signature file.You can edit it using this simple steps,this will guarantee you a perfect social engineering and AV by passing.

1.Decompile your apk with apktool - apktool d /path/to/apk /path/to/decompilefolder

2.Edit what you need like the Name of the apkfile located at the rest/values/strings.xml or you can add an icon by making a folder by

drawable-ldpi
drawable-mdpi
drawable-hdpi

in the rest directory and add the your icon with 48px icon in the "drawable-ldpi" and 36px icon in the "drawable-mdpi" and 72px icon in the "drawable-hdpi" and edit the AndroidMenifest.XML file and add this line android:icon=@drawable/icon and make sure you name all your icons with the name icon.png.

Then complie this by this code apktool b /path/to/decompilefolder then you will find the apk file in a filde named dist.Then you must sign the apk file with jarsigner ,this is where you change the signature.

jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA /path/to/apk androiddebugkey*

Decompile the apk or the Payload

can you give me video for it

You cab look at this tut at nullbyte and his previous one too.
https://null-byte.wonderhowto.com/how-to/embed-metasploit-payload-original-apk-file-part-2-do-manually-0167124/

hey JOHN, how u success in bending the payload with the original apk, can you make a video for editing the manifest and .Smali files,i follow the steps in this tutorial

https://null-byte.wonderhowto.com/how-to/embed-metasploit-payload-original-apk-file-part-2-do-manually-0167124/

but i am stuck in the editing issue any help plz ??