v26.7.1

Rule Enhancement

• Add new Quark rules for the NGate and Cerberus malware families. (#931 and #926)

Document Enhancement

• Add an analysis report for the SuperCardX malware family. (#927)

New Feature

• Add Phase 5 dynamic string resolution via DexTrace. (#919)

v26.6.1

Rule Enhancement

• Add new Quark rules for the BRATA, TangleBot, and Godfather malware families. (#917, #916, and #915)

v26.5.1

Rule Enhancement

• Add new Quark rules for the Antidot, Arsink, and TrickMo malware families. (#903, #907, and #909)

Bug Fixes

• Separate filled-new-array parsing from invoke-kind handling to avoid incorrect bytecode classification. (#867 and #886)

v26.4.1

Document Enhancements

• Add analysis report for Hydra malware family. (#892)
• Add analysis report for SharkBot malware family. (#900)

Bug Fixes

• Fix issues where type-casting and invoke-polymorphic instructions were skipped during analysis. Thanks to @dolamroth. (#872 and #874)
• Fix incorrect type hints in helper functions. Thanks to @dolamroth. (#885)
• Fix incomplete tracking of registers holding array objects. (#890)

Dependency Update

• Bump Flask from 2.2.5 to 3.1.3. (#865)

v26.3.1

Performance Improvement

• Record register usage instead of full state to reduce memory usage. (#845)

Document Enhancement

• Add an analysis report for the ToxicPanda malware family. (#863)

New Feature

• Add a safe DEX checksum auto-repair flow for androguard-based parsing. (#866)

v26.2.1

Dependency Update

• Bump requests max version to 2.32.3. (#856)

Document Enhancement

• Reconstruct documentation. (#857)

New Feature

• Add support for handling semi-corrupted Android APKs (#859)

v26.1.1

• Rule Enhancement

  • Add 5 new rules for the PhantomCard malware family. (#843)

• Document Enhancement

  • Add an analysis report for the PhantomCard malware family. (#843)
  • Optimize the Quark Script documents for CWE-749 and CWE-927. (#842 and #844)

v25.12.1

Rule Enhancement

• Add 1 new rules for the SLocker malware family (#832)

Document Enhancement

• Add an analysis report for the SLocker malware family. (#832)
• Optimize the document of Quark Script CWE-780 and CWE-940. (#829, #831)

v25.11.1

Rule Enhancement

• Add 3 new rules for the DawDropper malware family (#822)

Document Enhancement

• Optimize the document of Quark Script CWE-601 and CWE-926. (#821, #823)
• Add an analysis report for the DawDropper malware family. (#822)

v25.9.1

• Document Enhancement

  • Add an analysis report for the GoldDream malware family. (#780)
  • Update the GitHub release process documentation. (#791)
  • Optimize the Quark Script document for CWE-256. (#804)

• Rule Enhancement

  • Add 4 new rules for the GoldDream malware family (#780)

• New Feature

  • Add Quark Script APIs and showcase for detecting CWE-359. (#802, #803)