Evading Android Runtime Analysis via Sandbox Detection

The large amounts of malware, and its diversity, have made it nec-essary for the security community to use automated dynamic anal-ysis systems. These systems often rely on virtualization or emu-lation, and have recently started to be available to process mobile malware. Conversely, malware authors seek to detect such systems and evade analysis. In this paper, we present techniques for detect-ing Android runtime analysis systems. Our techniques are classi-fied into four broad classes showing the ability to detect systems based on differences in behavior, performance, hardware and soft-ware components, and those resulting from analysis system design choices. We also evaluate our techniques against current publicly accessible systems, all of which are easily identified and can there-fore be hindered by a motivated adversary. Our results show some fundamental limitations in the viability of dynamic mobile malware analysis platforms purely based on virtualization