Analyzing with MVT

This page is for analysts, helplines, and technical supporters who received a Bugbane export and want to analyze it with MVT (Mobile Verification Toolkit).

The short version: a Bugbane export is an AndroidQF-format acquisition, encrypted with age. Decrypt it, and mvt-android check-androidqf consumes it directly.

Warning: The archive contains personal data from someone who trusted you with it. Analyze it only with the owner’s informed consent, keep it encrypted at rest, and delete what you no longer need. The SocialTIC forensics guide covers consent and evidence handling well.

What you should have received #

The archive, named like acquisition-1a2b3c4d.zip.age.
The passphrase (32 alphanumeric characters), which should have arrived through a different channel.

1. Install the tools #

You need age and MVT:

# age: via your package manager, e.g.
brew install age        # macOS
apt install age         # Debian/Ubuntu

# MVT: pipx is the recommended way
pipx install mvt

2. Decrypt the archive #

age --decrypt -o acquisition.zip acquisition-1a2b3c4d.zip.age

age asks for the passphrase interactively. The result is a plain ZIP in AndroidQF layout.

Note: Work on a copy, and check integrity first: the archive contains a hashes.csv with the SHA-256 of every artifact, and an acquisition.json with the acquisition’s UUID, timestamps and per-module status — useful both for verification and for your case documentation.

3. Get indicators of compromise #

Download the public STIX2 indicators indexed by the MVT project:

mvt-android download-iocs

Downloaded indicators load automatically on every check. You can add private or additional STIX2 files with repeated --iocs flags, or through the MVT_STIX2 environment variable.

4. Run the check #

check-androidqf accepts the ZIP directly, or the unzipped directory:

mvt-android check-androidqf --output results/ acquisition.zip

Useful flags: --iocs FILE for extra indicators, --list-modules to see what runs, --module NAME to run one module, and --virustotal to look up APK hashes (requires MVT_VT_API_KEY).

5. Read the results #

In the output directory you will find:

one <module>.json per module, with all extracted records;
<module>_detected.json files only where something matched an indicator — start here;
timeline.csv, a chronological view across all modules;
info.json and command.log for the run itself.

Remember the usual caveat, which MVT’s own documentation stresses too: public indicators are not sufficient to determine that a device is clean. No detection means no detection — not absence of compromise.

Good to know #

The acquirer’s own ADB key. Bugbane acquires over the device’s own Wireless Debugging, so its ADB public key legitimately appears on the device. The archive ships it as adb_host_key.pub (and inside acquisition.json), so you can tell it apart from unknown keys.
acquisition.json reports Bugbane’s version in the androidqf_version field (as Bugbane-<version>), plus any failed or skipped modules — check it before concluding an artifact is missing.
Old MVT workflows don’t apply. Recent MVT removed check-adb; check-androidqf is the supported path for this kind of acquisition.
Want to know what each file in the archive contains? See the artifact reference.