The Droid is in the Details: Environment-aware Evasion of Android Sandboxes

Najmeh Miramirkhani, Brian Kondracki, Babak AminAzad

Abstract:

Malware sandboxes have long been a valuable tool
for detecting and analyzing malicious software. The proliferation
of mobile devices and, subsequently, mobile applications, has led
to a surge in the development and use of mobile device sandboxes
to ensure the integrity of application marketplaces. In turn,
to evade these sandboxes, malware has evolved to suspend its
malicious activity when it is executed in a sandbox environment.
Sophisticated malware sandboxes attempt to prevent sandbox
detection by patching runtime properties indicative of malwareanalysis systems.