Quark Engine — authorized Android malware scoring
Quark Engine (ev-flow/quark-engine) is an Android malware scoring toolkit. Release v26.10.1 (2026-10-10 UTC) was the latest checked on 2026-10-24. License is GPL-3.0. Score only APKs you are authorized to analyze in isolated labs.
Snapshot
| Field | Value |
|---|---|
| License | GPL-3.0 |
| Latest checked | v26.10.1 (2026-10-10 UTC) |
| Job | Rule-based Android malware scoring / family reports |
| Stars (order of magnitude) | ~1.7k on GitHub (counts change daily) |
| Peers | MobSF, Androguard, APKiD |
Allowed framing
- Scoring ticketed malware APKs in IR sandboxes.
- Classroom labs with public research samples under policy.
- Comparing Quark scores with jadx/MobSF notes on the same authorized package.
Scope we will not cover
- No malware authoring cookbooks.
- No “make undetectable APK” framing.
- No Play Integrity / store / DRM bypass recipes.
Beginner path (authorized only)
- Prefer an isolated lab VM; never score production user devices casually.
- Install from official ev-flow/quark-engine Releases or PyPI
quark-engine==26.10.1. - Start with a documented public research sample your policy allows, or an APK you built as a negative control.
- Read scores as hypotheses; confirm with jadx/MobSF before case decisions.
- Keep Quark, rule-pack and APK hashes in the case ledger.
- Use Quark Engine for authorized Android malware scoring.
- Prefer MobSF/jadx for broader assessment or decompilation.
- Refuse malware-authoring and bypass framing.
For legal, authorized and educational use only.
FAQ
What is Quark Engine?
Quark Engine is an Android malware scoring system that evaluates APKs against rule packs (including family-oriented reports) with an emphasis on remaining useful under obfuscation. It is for authorized malware research and education — not for writing malware.
Which version is cited?
v26.10.1 published 2026-10-10 UTC on ev-flow/quark-engine Releases; PyPI quark-engine 26.10.1 matches (checked 2026-10-24). Calendar-style versioning (YY.MM.patch).
What license applies?
GNU GPL v3; GitHub reports GPL-3.0 (checked 2026-10-24).
MobSF/Androguard or Quark?
Prefer MobSF for all-in-one assessment UIs. Prefer Androguard for Python APK structure. Prefer Quark when you want rule-based malware scoring reports on authorized samples.
Does this teach writing Android malware?
No. Scoring and education only — BinBench will not supply malware templates, C2 kits or store-bypass recipes.