A configurable sandbox for dynamic analysis of Android malware using Frida hooks to bypass anti-emulation techniques.
Android Malware Sandbox is a configurable sandbox environment for dynamically analyzing Android malware. It executes APK files in an emulated Android device, using Frida hooks to monitor behavior and bypass anti-emulation techniques. The tool generates reports to help security researchers understand malware capabilities and evasion methods.
Security researchers, malware analysts, and reverse engineers focused on Android threat intelligence who need a flexible environment for dynamic malware analysis.
It offers a modular, extensible sandbox with built-in anti-emulation bypasses, allowing rapid analysis of both known and unknown malware families without complex setup.
Android Malware Sandbox
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Executes APK files in an Android Virtual Device or Docker container to monitor runtime activities, providing insights into malware actions during execution, as highlighted in the README's key features.
Uses Frida hooks to circumvent common malware anti-emulation checks, helping analysts avoid detection by sophisticated threats, a core feature mentioned in the README.
Settings such as emulator paths, snapshot usage, and data wiping are easily adjustable via a config.ini file, allowing customization for different analysis scenarios, as described in the installation section.
Supports custom plugins to add new Frida hooks, enabling researchers to monitor specific API calls or adapt to evolving malware techniques, with plugin requirements detailed in the hooking section.
Generates HTML reports and logs results in a SQLite database, facilitating documentation and review of analysis findings, though the README notes reporting needs improvement.
The README explicitly states that 'reporting needs improvement,' with more details available only in debug logs and the database, limiting out-of-the-box insights for quick analysis.
Requires installation of Android Studio or AVD, Python dependencies, npm packages, and manual configuration of paths in config.ini, which can be time-consuming and error-prone, as outlined in the installation steps.
Relies on Android emulators or Docker containers, which may not fully replicate real-device behavior and could be bypassed by advanced anti-emulation techniques not yet hooked, as implied by the need for new contributions.
Uses external scripts for Docker and has a TODO item to 'Improve dockerisation,' indicating that containerized analysis might be less stable or feature-complete compared to AVD-based runs.