JunWei Song 宋駿瑋

0x00 Contact

Email

junwei.song.info@gmail.com

LinkedIn

linkedin.com/in/jweisong

GitHub

github.com/krnick

X

@JunWei__Song

Blog

krnick.github.io/post

Location

Taiwan · GMT+8 · Remote

0x01 Summary

JunWei is a senior malware research analyst at Recorded Future Triage Sandbox, interested in the field of reverse engineering, malware analysis, threat intelligence, and developing tools to aid malware analysis. He has been very involved in the security community, previously leading Quark-Engine and mentoring GSoC under the Honeynet Project.

Outside of work, he volunteers for the PyCon TW community, has been a member of the Review Board since 2020, and served as the PyCon APAC 2022 Program Chair. He is passionate about contributing to the community and helping to organize the PyCon Taiwan program committee.

He also enjoys sharing his security and malware research through talks. He has presented at various security conferences, such as Black Hat Asia, DEF CON BTV, Virus Bulletin, HITB, and ROOTCON.

0x02 Experience

Recorded Future — Triage Sandbox · Amsterdam, Netherlands · Remote

• Research and analyze the latest malware families and variants.
• Develop and implement advanced malware signatures and extractors to enhance threat detection.
• Regularly publish research findings, providing deep insights to the cybersecurity community.
• Collaborate with cross-functional teams to improve the threat intelligence platform and support clients in mitigating malware threats.

Recorded Future — Triage Sandbox

Hatching International B.V. · Amsterdam, Netherlands

• Researched and analyzed the latest malware families and their variants.
• Wrote malware signatures and extractors.

Telecom Technology Center (電信技術中心)

• Focused on Android malware analysis and automated detection design.
• Used open-source tooling — jadx, radare2, Ghidra, Frida and Quark-Engine — to investigate internal and external Android applications.
• Published research at conferences including Black Hat, DEF CON, HITB, ROOTCON and PyCon.
• Designed and developed the open-source project Quark-Engine, which was accepted by several top security conferences and integrated into many well-known open-source projects.

0x03 Open Source

• Quark-Engine Creator / co-founder

  Android malware scoring and analysis framework; packaged in the official Kali Linux repositories (also package maintainer). Adopted by a wide range of third-party reverse-engineering tooling, including jadx, MobSF and APKLab for VS Code.

• c2hunt Creator

  Command-line tool to detect and extract C2 commands from Android APK/DEX via custom Smali opcode analysis — the reference implementation behind the Virus Bulletin 2025 paper.

• sunzip Creator
• Androguard Contributor & PyPI maintainer

  Core Android reverse-engineering toolkit.

• Google Summer of Code Mentor, since 2021

  Mentor for the Quark-Engine project under the Honeynet Project.

• CPython Contributor

  Also credited with CVE-2019-9674 — see disclosures below.

• Rizin Contributor

  UNIX-like reverse-engineering framework.

0x04 Published Research

• Hunting Potential C2 Commands in Android Malware via Smali String Comparison and Control Flow Analysis Virus Bulletin 2025, Berlin

  Proposed a novel static-analysis methodology to automatically locate functions likely containing C2 commands, addressing the limitations of dynamic analysis (encryption, obfuscation, dead C2 servers, anti-analysis). The method detects structured patterns — multiple string comparisons in if-else/switch blocks and HashMap-based command mappings — via Smali opcode frequency analysis (const-string, invoke-virtual, if-eqz) and Android API calls, remaining effective even against encrypted/obfuscated commands. Built the tooling in Python + Androguard (released as c2hunt), validated across Octo, Copybara, Cerberus, XLoader and other families, and used it to identify a new version of the TgToxic banking trojan.

  [paper] [slides] [video]

Triage Insights — sole author of Recorded Future / Hatching's technical malware-analysis series:

• Octo Android Banker 2023

  Authored the inaugural post of the series; end-to-end analysis of the Octo banking trojan, covering dynamic code loading (DCL) evasion, C2 config extraction, and AES/RC4/MD5 traffic decryption.

• Detection Evasion in Android APK Headers 2024

  Original byte-level research into anti-static-analysis techniques abusing malformed APK/ZIP and AXML headers (compression method, magic number, stringCount, attribute size, namespace end node); manually reconstructed corrupted structures and shipped static signatures to detect the technique.

• TgToxic v2 2024

  First public analysis of the resurfaced TgToxic Android banking trojan; reverse-engineered 94 C2 commands, WebSocket/AES/Base64 C2 protocol, C2 infrastructure, and 21 targeted locales, delivering detection and config extraction.

Thesis

• A Study of Android Malware Detection Based on Permission and API Calls Pattern M.S. thesis, 2020

  以應用程序權限與介面呼叫模型偵測 Android 惡意程式之研究

  Machine-learning classifiers (Decision Tree, GBM, XGBoost, SVM, Naïve Bayes) over permission requests, API calls and API call sequences; achieved 97.2% classification accuracy on AndroZoo samples.

0x05 Security Disclosures

• CVE-2019-9674 CPython

  Discovered and responsibly disclosed a ZIP bomb (nested-archive) denial-of-service vulnerability in CPython's Lib/zipfile.py (Python ≤ 3.7.2). Reported via the Python bug tracker (bpo-36260 / bpo-36462), leading to an official Python security documentation update and downstream advisories from Red Hat, Ubuntu, SUSE, and NetApp.

0x06 Technical Book Reviews

Served as technical reviewer (審校) for two reverse-engineering / low-level programming books published by DrMaster Press (博碩文化), Taiwan — under my Chinese name 宋駿瑋:

• 《職業駭客的修練：機械碼與底層的把玩藝術》 2016 Machine code, disassembly, assembly, and Windows PE for reverse engineering
• 《職業駭客的告白 III 部曲 — C語言、組合語言與逆向工程的秘密》 C, assembly, and reverse-engineering fundamentals

0x07 Talks

Consolidated at github.com/krnick/talks.

2025

• Virus Bulletin 2025 Hunting potential C2 commands in Android malware via Smali string comparison and control flow analysis [info]
• PyCon TW 2025 Practical Python Malware Analysis [info]

2021

• Black Hat Asia 2021 Arsenal Quark Engine: Storyteller of Android Malware [info]
• Oh My H@ck 2021 invited [info]

2020

• HITB Armory Amsterdam 2020 Quark Engine: An Obfuscation-Neglect Android Malware Scoring System [info]
• EuroPython 2020 So, You Want to Build an Anti-Virus Engine? [info][video]
• HITB Lockdown 002 Quark Engine: An Obfuscation-Neglect Android Malware Scoring System [info][video]
• DEF CON 28 BTV Quark Engine: An Obfuscation-Neglect Android Malware Scoring System [video]
• PyCon TW 2020 So, You Want to Build an Anti-Virus Engine? [video]
• ROOTCON 2020 Quark Engine (invited) [video]
• PyCon India 2020 So, You Want to Build an Anti-Virus Engine? [video]
• GrayHat 2020 Quark Engine (invited) [video]
• GrayHat 2020 Armory Quark Engine (invited) [video]

2019

• PyCon Taiwan 2019 Click Click Boom! Bombs Over Our Minds! [info][video]
• PyCon Malaysia 2019 Click Click Boom! Bombs Over Our Minds! [video]
• PyCon Korea 2019 Click Click Boom! Bombs Over Our Minds! [video]

0x08 Community

• PyCon Taiwan Volunteer & Review Board member (since 2020); Program Committee
• PyCon APAC 2022 Program Chair

0x09 Skills

Core

Reverse Engineering · Malware Analysis · YARA · Detection Engineering · Config Extraction

Platforms

Android/APK Static Analysis · ELF/PE Analysis · Windows / Linux / macOS

Frameworks

MITRE ATT&CK (Enterprise + Mobile) · APT Research · Threat Intelligence

Programming

Python (CPython contributor) · Go

Leadership

Open Source Maintenance · Mentoring (GSoC) · Conference Program Chair