Android Malware Sandbox
A configurable sandbox for dynamic analysis of Android malware using Frida hooks to bypass anti-emulation techniques.
What is Android Malware Sandbox?
Android Malware Sandbox is a configurable sandbox environment for dynamically analyzing Android malware. It executes APK files in an emulated Android device, using Frida hooks to monitor behavior and bypass anti-emulation techniques. The tool generates reports to help security researchers understand malware capabilities and evasion methods.
Security researchers, malware analysts, and reverse engineers focused on Android threat intelligence who need a flexible environment for dynamic malware analysis.
It offers a modular, extensible sandbox with built-in anti-emulation bypasses, allowing rapid analysis of both known and unknown malware families without complex setup.
Overview
Android Malware Sandbox
Use Cases
Best For
- Analyzing new Android malware families in a controlled environment
- Bypassing anti-emulation techniques used by sophisticated malware
- Dynamic behavior analysis of APK files during execution
- Security research and malware sample triage
- Extending malware analysis capabilities with custom Frida hooks
- Automated reporting of malware activities for threat intelligence
Not Ideal For
- Environments requiring analysis on physical Android devices instead of emulation
- Teams needing comprehensive static analysis capabilities alongside dynamic execution
- Large-scale malware analysis pipelines with fully automated, hands-off configuration
- Organizations with strict security policies prohibiting the use of emulators or Docker containers
Pros & Cons
Pros
Executes APK files in an Android Virtual Device or Docker container to monitor runtime activities, providing insights into malware actions during execution, as highlighted in the README's key features.
Uses Frida hooks to circumvent common malware anti-emulation checks, helping analysts avoid detection by sophisticated threats, a core feature mentioned in the README.
Settings such as emulator paths, snapshot usage, and data wiping are easily adjustable via a config.ini file, allowing customization for different analysis scenarios, as described in the installation section.
Supports custom plugins to add new Frida hooks, enabling researchers to monitor specific API calls or adapt to evolving malware techniques, with plugin requirements detailed in the hooking section.
Generates HTML reports and logs results in a SQLite database, facilitating documentation and review of analysis findings, though the README notes reporting needs improvement.
Cons
The README explicitly states that 'reporting needs improvement,' with more details available only in debug logs and the database, limiting out-of-the-box insights for quick analysis.
Requires installation of Android Studio or AVD, Python dependencies, npm packages, and manual configuration of paths in config.ini, which can be time-consuming and error-prone, as outlined in the installation steps.
Relies on Android emulators or Docker containers, which may not fully replicate real-device behavior and could be bypassed by advanced anti-emulation techniques not yet hooked, as implied by the need for new contributions.
Uses external scripts for Docker and has a TODO item to 'Improve dockerisation,' indicating that containerized analysis might be less stable or feature-complete compared to AVD-based runs.
Frequently Asked Questions
Related Projects
Mobile-Security-Framework MobSFMobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
DrozerThe Leading Security Assessment Framework for Android.
Runtime Mobile Security (RMS)Runtime Mobile Security (RMS) 📱🔥 - is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime
InspeckageAndroid Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.